Edit tour

Windows Analysis Report
p2K.exe

Overview

General Information

Sample name:	p2K.exe
Analysis ID:	1521694
MD5:	b8974a6a9406e8c8d4345f6dcba034b2
SHA1:	4f4d2e7e11bce3c45abb0fb182513627357be9a2
SHA256:	6a6b6d460945b063180ee5a4580d29ee01f3bd1a2c5c82684512093e3655ba00
Infos:

Detection

Score:	35
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

AI detected suspicious sample

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

p2K.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\p2K.exe" -pF5Vt8d1X0LWj MD5: B8974A6A9406E8C8D4345F6DCBA034B2)

assignee.exe (PID: 5356 cmdline: "C:\ProgramData\assignee\assignee.exe" "2YgTMci4EewqpK" MD5: DA4E8EBC459D4E4FA60C17B7E25ECBB4)

assignee.exe (PID: 356 cmdline: "C:\ProgramData\assignee\assignee.exe" MD5: DA4E8EBC459D4E4FA60C17B7E25ECBB4)

cleanup

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\p2K.exe, ProcessId: 6600, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\assignee.lnk

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.3% probability

Source: p2K.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\p2K.exe

File opened: C:\ProgramData\assignee\msvcr100.dll

Jump to behavior

Source: p2K.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: p2K.exe, 00000000.00000000.2111554546.000000000101C000.00000002.00000001.01000000.00000003.sdmp, p2K.exe, 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\win32api.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369844568.000000006CA7E000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: msvcr100.i386.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3370644200.000000006CB01000.00000020.00000001.01000000.0000000C.sdmp, assignee.exe, 00000004.00000002.2317109606.000000006CB01000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: ,C:\Users\martin\34\python\PCbuild\_socket.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3373393865.0000000074A97000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\python34.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3370875187.000000006CCFE000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\win32api.pdb. source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369844568.000000006CA7E000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\pywintypes.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369736236.000000006CA5C000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\pywintypes.pdb( source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369736236.000000006CA5C000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_tkinter.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369628655.000000006CA37000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: &C:\Users\martin\34\python\PCbuild\_ssl.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_ssl.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: p[,C:\Users\martin\34\python\PCbuild\unicodedata.pdb)6 source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_socket.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3373393865.0000000074A97000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\unicodedata.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 9'C:\Users\martin\34\python\PCbuild\_tkinter.pdbif source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369628655.000000006CA37000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: -C:\Users\martin\34\python\PCbuild\python34.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3370875187.000000006CCFE000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_ctypes.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3372735764.000000006D51F000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: ,C:\Users\martin\34\python\PCbuild\_ctypes.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3372735764.000000006D51F000.00000002.00000001.01000000.0000000D.sdmp

Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FEF826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00FEF826
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01001630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_01001630
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01011FF8 FindFirstFileExA,	0_2_01011FF8
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DFE00 CreateFileW,GetFileInformationByHandle,CloseHandle,_errno,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetFileAttributesExW,GetLastError,GetLastError,FindFirstFileW,GetLastError,TclWinConvertError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	4_2_6C9DFE00
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DEF60 Tcl_FSGetNormalizedPath,Tcl_FSGetInternalRep,GetFileAttributesW,Tcl_GetStringFromObj,Tcl_DStringAppend,Tcl_DStringAppend,strpbrk,Tcl_DStringAppend,Tcl_WinUtfToTChar,FindFirstFileExW,FindFirstFileW,GetLastError,Tcl_DStringFree,TclWinConvertError,Tcl_PosixError,Tcl_ObjPrintf,Tcl_SetObjResult,Tcl_DStringFree,Tcl_DStringFree,Tcl_DStringSetLength,Tcl_ExternalToUtfDString,Tcl_StringCaseMatch,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_ListObjAppendElement,Tcl_DStringFree,FindNextFileW,FindClose,Tcl_DStringFree,Tcl_FSGetNormalizedPath,Tcl_GetString,Tcl_FSGetInternalRep,GetFileAttributesExW,Tcl_ListObjAppendElement,	4_2_6C9DEF60
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9E0590 Tcl_GetString,Tcl_UtfToExternalDString,GetFileAttributesExW,Tcl_AppendLimitedToObj,Tcl_GetString,Tcl_GetString,TclFreeObj,TclpFree,TclpFree,FindFirstFileW,FindClose,Tcl_DStringAppend,Tcl_DStringAppend,TclpFree,Tcl_DStringAppend,TclpFree,Tcl_ExternalToUtfDString,Tcl_NewStringObj,Tcl_AppendLimitedToObj,Tcl_GetString,Tcl_SetStringObj,TclFreeObj,Tcl_SetStringObj,TclpFree,TclpFree,TclFreeObj,	4_2_6C9E0590
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DDD00 Tcl_FSSplitPath,Tcl_ListObjIndex,Tcl_GetString,Tcl_FSJoinPath,Tcl_GetString,Tcl_UtfToExternalDString,TclFreeObj,FindFirstFileW,GetFileAttributesW,Tcl_DStringFree,Tcl_FSJoinPath,TclFreeObj,Tcl_ExternalToUtfDString,Tcl_DStringFree,TclpAlloc,Tcl_Panic,Tcl_AppendToObj,Tcl_DStringFree,Tcl_ListObjReplace,FindClose,Tcl_DStringFree,TclFreeObj,Tcl_GetString,Tcl_ObjPrintf,Tcl_SetObjResult,_errno,_errno,_errno,Tcl_ErrnoMsg,Tcl_ErrnoId,Tcl_SetErrorCode,	4_2_6C9DDD00
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DD710 GetFileAttributesW,Tcl_DStringAppend,Tcl_DStringSetLength,FindFirstFileW,GetLastError,TclWinConvertError,GetLastError,_errno,Tcl_DStringSetLength,Tcl_DStringSetLength,FindClose,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringSetLength,Tcl_DStringSetLength,FindNextFileW,FindClose,Tcl_DStringSetLength,Tcl_DStringSetLength,Tcl_DStringSetLength,Tcl_DStringSetLength,_errno,Tcl_ExternalToUtfDString,	4_2_6C9DD710

Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/licenses/by-nc-sa/3.0/
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/licenses/by-sa/3.0/)
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#Attribution
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#CommercialUse
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#DerivativeWorks
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#Distribution
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#Notice
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#Reproduction
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#ShareAlike
Source: p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: assignee.exe, 00000002.00000002.3370875187.000000006CCFE000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369889725.000000006CA88000.00000002.00000001.01000000.00000020.sdmp, assignee.exe, 00000004.00000002.2316308925.000000006CA88000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://pywin32.sourceforge.net
Source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369781184.000000006CA6A000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://pywin32.sourceforge.net0
Source: p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.apple.com/kb/HT1343
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tango.freedesktop.org/Tango_Desktop_Project
Source: assignee.exe, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml)-r)
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inkscape.org/)
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inria.fr/koala/colas/mouse-wheel-scroll/
Source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/sax/properties/encoding
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/sax/properties/interning-dict
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interningz&http://xml.org/sax/features/validationz5http://xml.org
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/dom-node
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: assignee.exe	String found in binary or memory: http://xml.org/sax/properties/lexical-handlerz1http://xml.org/sax/properties/declaration-handlerz&ht
Source: assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: assignee.exe, 00000002.00000002.3367817874.00000000042F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.info/q/getreceivedbyaddress/
Source: p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/pypa/packagingz
Source: assignee.exe, assignee.exe, 00000004.00000002.2311024840.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.html
Source: p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000000.2184489626.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000002.2311024840.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.htmlfor
Source: assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://pypi.org/project/segno/
Source: assignee.exe, 00000002.00000002.3367898833.0000000004370000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313737655.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://shapeshift.banxa.com?coinAmount=0.00196201&coinType=BTC&walletAddress=bc1qmz279qhl6dumwfqccd

Source: C:\ProgramData\assignee\assignee.exe

Code function: 2_2_6C879CE0 OpenClipboard,EmptyClipboard,TkWinGetPlatformId,SetClipboardData,SetClipboardData,CloseClipboard,

2_2_6C879CE0

Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C879CE0 OpenClipboard,EmptyClipboard,TkWinGetPlatformId,SetClipboardData,SetClipboardData,CloseClipboard,		2_2_6C879CE0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C879D50 TkWinClipboardRender,Tcl_Alloc,Tcl_DStringInit,Tcl_UtfToUniCharDString,Tcl_Free,GlobalAlloc,Tcl_DStringFree,GlobalLock,memcpy,GlobalUnlock,Tcl_DStringFree,SetClipboardData,		2_2_6C879D50

Source: C:\ProgramData\assignee\assignee.exe

Code function: 2_2_6C87A040 TkSelGetSelection,Tk_InternAtom,OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,Tcl_DStringInit,Tcl_UniCharLen,Tcl_UniCharToUtfDString,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,Tcl_DStringInit,Tcl_DStringAppend,GlobalLock,GetLocaleInfoA,GlobalUnlock,Tcl_GetEncoding,Tcl_DStringFree,GetClipboardData,Tcl_FreeEncoding,CloseClipboard,GlobalLock,Tcl_ExternalToUtfDString,GlobalUnlock,Tcl_FreeEncoding,CloseClipboard,Tcl_DStringFree,CloseClipboard,Tk_GetAtomName,Tk_GetAtomName,Tcl_ObjPrintf,Tcl_SetObjResult,Tcl_SetErrorCode,

2_2_6C87A040

Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C86D560 MapVirtualKeyW,MapVirtualKeyW,memset,ToAscii,ToAscii,VkKeyScanW,MapVirtualKeyW,memset,ToAscii,GetKeyState,GetKeyState,GetKeyState,		2_2_6C86D560
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C868390 TkWinGetModifierState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		2_2_6C868390

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_00FE9B5C: _wcslen,CreateFileW,CloseHandle,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00FE9B5C

Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FF355D	0_2_00FF355D
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FFB76F	0_2_00FFB76F
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FEBF3D	0_2_00FEBF3D
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FFA008	0_2_00FFA008
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_0100C0D6	0_2_0100C0D6
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01014360	0_2_01014360
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FFC27F	0_2_00FFC27F
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FFA222	0_2_00FFA222
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FF5214	0_2_00FF5214
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_010092D0	0_2_010092D0
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FF46CF	0_2_00FF46CF
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_010186D2	0_2_010186D2
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FE48AA	0_2_00FE48AA
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_0101480E	0_2_0101480E
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FE5AFE	0_2_00FE5AFE
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FFABC8	0_2_00FFABC8
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FE7CBA	0_2_00FE7CBA
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FFBC05	0_2_00FFBC05
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FE3D9D	0_2_00FE3D9D
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FF4D32	0_2_00FF4D32
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_0100BEA7	0_2_0100BEA7
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FE5F39	0_2_00FE5F39
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FF5F0B	0_2_00FF5F0B
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C87A660	2_2_6C87A660
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C80A100	2_2_6C80A100
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DB2C0	4_2_6C9DB2C0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92ECE0	4_2_6C92ECE0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C96CCE0	4_2_6C96CCE0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C930C20	4_2_6C930C20
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C933C60	4_2_6C933C60
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9B4D10	4_2_6C9B4D10
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9CFD30	4_2_6C9CFD30
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C91CED0	4_2_6C91CED0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92AEC0	4_2_6C92AEC0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C932EC0	4_2_6C932EC0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C920E10	4_2_6C920E10
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92FE19	4_2_6C92FE19
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C935E40	4_2_6C935E40
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92BE70	4_2_6C92BE70
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92CF30	4_2_6C92CF30
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9318D0	4_2_6C9318D0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9238E0	4_2_6C9238E0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C924830	4_2_6C924830
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92F860	4_2_6C92F860
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9D29A0	4_2_6C9D29A0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C936900	4_2_6C936900
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C930940	4_2_6C930940
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9B6970	4_2_6C9B6970
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C941A80	4_2_6C941A80
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C990AD0	4_2_6C990AD0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C8FAAD0	4_2_6C8FAAD0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C969A40	4_2_6C969A40
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C946B90	4_2_6C946B90
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C944BE0	4_2_6C944BE0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92CB70	4_2_6C92CB70
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C93D4C0	4_2_6C93D4C0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C935430	4_2_6C935430
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92D450	4_2_6C92D450
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9285A0	4_2_6C9285A0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9145C0	4_2_6C9145C0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C955510	4_2_6C955510
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C91F500	4_2_6C91F500
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9E6530	4_2_6C9E6530
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C915540	4_2_6C915540
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92E6B0	4_2_6C92E6B0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9A76D0	4_2_6C9A76D0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C922650	4_2_6C922650
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C91D660	4_2_6C91D660
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C93C7A0	4_2_6C93C7A0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C929700	4_2_6C929700
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92B700	4_2_6C92B700
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C921770	4_2_6C921770
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92E010	4_2_6C92E010
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9311B0	4_2_6C9311B0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92F2C0	4_2_6C92F2C0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DA220	4_2_6C9DA220
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C927270	4_2_6C927270
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9333D0	4_2_6C9333D0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C92C310	4_2_6C92C310
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C929360	4_2_6C929360

Source: C:\Users\user\Desktop\p2K.exe	Code function: String function: 010057D8 appears 67 times
Source: C:\Users\user\Desktop\p2K.exe	Code function: String function: 010057A5 appears 34 times
Source: C:\Users\user\Desktop\p2K.exe	Code function: String function: 01006630 appears 31 times
Source: C:\ProgramData\assignee\assignee.exe	Code function: String function: 6C9AF7A0 appears 183 times
Source: C:\ProgramData\assignee\assignee.exe	Code function: String function: 6C9B45E0 appears 270 times
Source: C:\ProgramData\assignee\assignee.exe	Code function: String function: 6C9B2180 appears 220 times
Source: C:\ProgramData\assignee\assignee.exe	Code function: String function: 6C9A2370 appears 1251 times
Source: C:\ProgramData\assignee\assignee.exe	Code function: String function: 6C9E9B80 appears 32 times

Source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcr100_clr0400.dll^ vs p2K.exe
Source: p2K.exe, 00000000.00000003.2176583196.000000000795E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametk86t.dllP vs p2K.exe
Source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython34.dll. vs p2K.exe
Source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes34.dllD vs p2K.exe
Source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametcl86t.dllP vs p2K.exe
Source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pydD vs p2K.exe

Source: p2K.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus35.winEXE@4/932@0/0

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_00FE932C GetLastError,FormatMessageW,_wcslen,LocalFree,

0_2_00FE932C

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_00FFE91A CoCreateInstance,

0_2_00FFE91A

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_00FFEBD3 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00FFEBD3

Source: C:\Users\user\Desktop\p2K.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\assignee.lnk

Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe	Command line argument: sfxname	0_2_0100454A
Source: C:\Users\user\Desktop\p2K.exe	Command line argument: sfxstime	0_2_0100454A
Source: C:\Users\user\Desktop\p2K.exe	Command line argument: STARTDLG	0_2_0100454A

Source: p2K.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\p2K.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: assignee.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: assignee.exe	String found in binary or memory: -startline must be less than or equal to -endline
Source: assignee.exe	String found in binary or memory: utracing-stop
Source: assignee.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: assignee.exe	String found in binary or memory: Usage: mimetypes.py [options] type Options: --help / -h -- print this message and exit --lenient / -l -- additionally search of some common, but non-standard types. --extension / -e -- guess extension instead of
Source: assignee.exe	String found in binary or memory: Usage: mimetypes.py [options] type Options: --help / -h -- print this message and exit --lenient / -l -- additionally search of some common, but non-standard types. --extension / -e -- guess extension instead of
Source: assignee.exe	String found in binary or memory: angle-addr-startr'
Source: assignee.exe	String found in binary or memory: angle-addr-startr'
Source: assignee.exe	String found in binary or memory: Usage: %s [OPTIONS] <file> [ARGS] Meta-options: --help Display this help then exit. --version Output version information then exit. Otherwise, exactly one of the following three options must be given: -t, --trace Print ea
Source: assignee.exe	String found in binary or memory: Usage: %s [OPTIONS] <file> [ARGS] Meta-options: --help Display this help then exit. --version Output version information then exit. Otherwise, exactly one of the following three options must be given: -t, --trace Print ea

Source: C:\Users\user\Desktop\p2K.exe

File read: C:\Users\user\Desktop\p2K.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\p2K.exe "C:\Users\user\Desktop\p2K.exe" -pF5Vt8d1X0LWj
Source: C:\Users\user\Desktop\p2K.exe	Process created: C:\ProgramData\assignee\assignee.exe "C:\ProgramData\assignee\assignee.exe" "2YgTMci4EewqpK"
Source: unknown	Process created: C:\ProgramData\assignee\assignee.exe "C:\ProgramData\assignee\assignee.exe"
Source: C:\Users\user\Desktop\p2K.exe	Process created: C:\ProgramData\assignee\assignee.exe "C:\ProgramData\assignee\assignee.exe" "2YgTMci4EewqpK"	Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\p2K.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: python34.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: pywintypes34.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: tcl86t.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: tk86t.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: python34.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: pywintypes34.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: tcl86t.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: tk86t.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: assignee.lnk.0.dr

LNK file: ..\..\..\..\..\..\..\..\..\ProgramData\assignee\assignee.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: p2K.exe

Static file information: File size 6985546 > 1048576

Source: C:\Users\user\Desktop\p2K.exe

File opened: C:\ProgramData\assignee\msvcr100.dll

Jump to behavior

Source: p2K.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: p2K.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: p2K.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: p2K.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: p2K.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: p2K.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: p2K.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: p2K.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: p2K.exe, 00000000.00000000.2111554546.000000000101C000.00000002.00000001.01000000.00000003.sdmp, p2K.exe, 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\win32api.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369844568.000000006CA7E000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: msvcr100.i386.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3370644200.000000006CB01000.00000020.00000001.01000000.0000000C.sdmp, assignee.exe, 00000004.00000002.2317109606.000000006CB01000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: ,C:\Users\martin\34\python\PCbuild\_socket.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3373393865.0000000074A97000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\python34.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3370875187.000000006CCFE000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\win32api.pdb. source: p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369844568.000000006CA7E000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\pywintypes.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369736236.000000006CA5C000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-3.4\Release\pywintypes.pdb( source: p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369736236.000000006CA5C000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_tkinter.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369628655.000000006CA37000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: &C:\Users\martin\34\python\PCbuild\_ssl.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_ssl.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: p[,C:\Users\martin\34\python\PCbuild\unicodedata.pdb)6 source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_socket.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3373393865.0000000074A97000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\unicodedata.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 9'C:\Users\martin\34\python\PCbuild\_tkinter.pdbif source: p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369628655.000000006CA37000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: -C:\Users\martin\34\python\PCbuild\python34.pdb source: p2K.exe, 00000000.00000003.2176583196.00000000074C0000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3370875187.000000006CCFE000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\martin\34\python\PCbuild\_ctypes.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3372735764.000000006D51F000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: ,C:\Users\martin\34\python\PCbuild\_ctypes.pdb source: p2K.exe, 00000000.00000003.2176583196.0000000007AC6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3372735764.000000006D51F000.00000002.00000001.01000000.0000000D.sdmp

Source: p2K.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: p2K.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: p2K.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: p2K.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: p2K.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\ProgramData\assignee\assignee.exe

Code function: 2_2_6C7A6150 Tk_GetHINSTANCE,GetModuleFileNameW,LoadLibraryW,GetProcAddress,

2_2_6C7A6150

Source: C:\Users\user\Desktop\p2K.exe

File created: C:\ProgramData\assignee\__tmp_rar_sfx_access_check_6045343

Jump to behavior

Source: p2K.exe	Static PE information: section name: .didat
Source: assignee.exe.0.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01005773 push ecx; ret	0_2_01005786
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01006680 push ecx; ret	0_2_01006693
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7818C5 push ecx; ret	2_2_6C7818D8
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C938B81 push ebx; iretd	4_2_6C938B8A
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9EB395 push ecx; ret	4_2_6C9EB3A8
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6CA36655 push ecx; ret	4_2_6CA36668

Source: msvcr100.dll.0.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\pywintypes34.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\python34.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\tk86t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\assignee.exe	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\tcl86t.dll	Jump to dropped file

Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\pywintypes34.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\python34.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\tk86t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\assignee.exe	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	File created: C:\ProgramData\assignee\tcl86t.dll	Jump to dropped file

Source: C:\ProgramData\assignee\assignee.exe

Code function: 4_2_6C9DF660 TclpGetUserHome,strchr,Tcl_UtfToUniCharDString,NetGetDCName,TclpFree,Tcl_UtfToUniCharDString,NetUserGetInfo,lstrlenW,Tcl_UniCharToUtfDString,NetApiBufferFree,GetWindowsDirectoryW,Tcl_UniCharToUtfDString,Tcl_DStringAppend,NetApiBufferFree,TclpFree,NetApiBufferFree,GetPrivateProfileStringA,GetWindowsDirectoryA,Tcl_DStringAppend,

4_2_6C9DF660

Source: C:\Users\user\Desktop\p2K.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\assignee.lnk

Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\assignee.lnk

Jump to behavior

Source: C:\ProgramData\assignee\assignee.exe

Code function: 2_2_6C85AD70 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,DrawMenuBar,

2_2_6C85AD70

Source: C:\Users\user\Desktop\p2K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\ProgramData\assignee\assignee.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man	Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\p2K.exe	Dropped PE file which has not been started: C:\ProgramData\assignee\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file

Source: C:\ProgramData\assignee\assignee.exe	API coverage: 2.5 %
Source: C:\ProgramData\assignee\assignee.exe	API coverage: 1.6 %

Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_00FEF826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00FEF826
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01001630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_01001630
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01011FF8 FindFirstFileExA,	0_2_01011FF8
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DFE00 CreateFileW,GetFileInformationByHandle,CloseHandle,_errno,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetFileAttributesExW,GetLastError,GetLastError,FindFirstFileW,GetLastError,TclWinConvertError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	4_2_6C9DFE00
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DEF60 Tcl_FSGetNormalizedPath,Tcl_FSGetInternalRep,GetFileAttributesW,Tcl_GetStringFromObj,Tcl_DStringAppend,Tcl_DStringAppend,strpbrk,Tcl_DStringAppend,Tcl_WinUtfToTChar,FindFirstFileExW,FindFirstFileW,GetLastError,Tcl_DStringFree,TclWinConvertError,Tcl_PosixError,Tcl_ObjPrintf,Tcl_SetObjResult,Tcl_DStringFree,Tcl_DStringFree,Tcl_DStringSetLength,Tcl_ExternalToUtfDString,Tcl_StringCaseMatch,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_ListObjAppendElement,Tcl_DStringFree,FindNextFileW,FindClose,Tcl_DStringFree,Tcl_FSGetNormalizedPath,Tcl_GetString,Tcl_FSGetInternalRep,GetFileAttributesExW,Tcl_ListObjAppendElement,	4_2_6C9DEF60
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9E0590 Tcl_GetString,Tcl_UtfToExternalDString,GetFileAttributesExW,Tcl_AppendLimitedToObj,Tcl_GetString,Tcl_GetString,TclFreeObj,TclpFree,TclpFree,FindFirstFileW,FindClose,Tcl_DStringAppend,Tcl_DStringAppend,TclpFree,Tcl_DStringAppend,TclpFree,Tcl_ExternalToUtfDString,Tcl_NewStringObj,Tcl_AppendLimitedToObj,Tcl_GetString,Tcl_SetStringObj,TclFreeObj,Tcl_SetStringObj,TclpFree,TclpFree,TclFreeObj,	4_2_6C9E0590
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DDD00 Tcl_FSSplitPath,Tcl_ListObjIndex,Tcl_GetString,Tcl_FSJoinPath,Tcl_GetString,Tcl_UtfToExternalDString,TclFreeObj,FindFirstFileW,GetFileAttributesW,Tcl_DStringFree,Tcl_FSJoinPath,TclFreeObj,Tcl_ExternalToUtfDString,Tcl_DStringFree,TclpAlloc,Tcl_Panic,Tcl_AppendToObj,Tcl_DStringFree,Tcl_ListObjReplace,FindClose,Tcl_DStringFree,TclFreeObj,Tcl_GetString,Tcl_ObjPrintf,Tcl_SetObjResult,_errno,_errno,_errno,Tcl_ErrnoMsg,Tcl_ErrnoId,Tcl_SetErrorCode,	4_2_6C9DDD00
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9DD710 GetFileAttributesW,Tcl_DStringAppend,Tcl_DStringSetLength,FindFirstFileW,GetLastError,TclWinConvertError,GetLastError,_errno,Tcl_DStringSetLength,Tcl_DStringSetLength,FindClose,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringAppend,Tcl_DStringSetLength,Tcl_DStringSetLength,Tcl_DStringSetLength,FindNextFileW,FindClose,Tcl_DStringSetLength,Tcl_DStringSetLength,Tcl_DStringSetLength,Tcl_DStringSetLength,_errno,Tcl_ExternalToUtfDString,	4_2_6C9DD710

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_01004E14 VirtualQuery,GetSystemInfo,

0_2_01004E14

Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: p2K.exe, 00000000.00000003.2185482147.0000000000760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: assignee.exe, 00000002.00000002.3366212400.0000000000718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\p2K.exe

API call chain: ExitProcess graph end node

graph_0-30164

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_01006878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_01006878

Source: C:\ProgramData\assignee\assignee.exe

Code function: 2_2_6C7A6150 Tk_GetHINSTANCE,GetModuleFileNameW,LoadLibraryW,GetProcAddress,

2_2_6C7A6150

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_0100ECAA mov eax, dword ptr fs:[00000030h]

0_2_0100ECAA

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_01012CE0 GetProcessHeap,

0_2_01012CE0

Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01006878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01006878
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01005BBF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01005BBF
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_01006A0B SetUnhandledExceptionFilter,	0_2_01006A0B
Source: C:\Users\user\Desktop\p2K.exe	Code function: 0_2_0100AAC4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0100AAC4
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C781155 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	2_2_6C781155
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9EABC1 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	4_2_6C9EABC1
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6CA35EA0 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	4_2_6CA35EA0

Source: C:\Users\user\Desktop\p2K.exe

Process created: C:\ProgramData\assignee\assignee.exe "C:\ProgramData\assignee\assignee.exe" "2YgTMci4EewqpK"

Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_01006694 cpuid

0_2_01006694

Source: C:\Users\user\Desktop\p2K.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_00FFFD34
Source: C:\ProgramData\assignee\assignee.exe	Code function: TkWinXInit,InitCommonControlsEx,Tcl_Panic,RegisterClassW,Tcl_Panic,GetKeyboardLayout,GetLocaleInfoW,TranslateCharsetInfo,TkWinXCleanup,	2_2_6C85A4D0
Source: C:\ProgramData\assignee\assignee.exe	Code function: TkSelGetSelection,Tk_InternAtom,OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,Tcl_DStringInit,Tcl_UniCharLen,Tcl_UniCharToUtfDString,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,Tcl_DStringInit,Tcl_DStringAppend,GlobalLock,GetLocaleInfoA,GlobalUnlock,Tcl_GetEncoding,Tcl_DStringFree,GetClipboardData,Tcl_FreeEncoding,CloseClipboard,GlobalLock,Tcl_ExternalToUtfDString,GlobalUnlock,Tcl_FreeEncoding,CloseClipboard,Tcl_DStringFree,CloseClipboard,Tk_GetAtomName,Tk_GetAtomName,Tcl_ObjPrintf,Tcl_SetObjResult,Tcl_SetErrorCode,	2_2_6C87A040

Source: C:\Users\user\Desktop\p2K.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\assignee.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Program Files (x86)\Internet Explorer\iexplore.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\init.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\auto.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\tk.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\tm.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\package.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\pkgIndex.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\opt0.4\pkgIndex.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\icons.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\button.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\entry.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\listbox.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\menu.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\panedwindow.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\scrlbar.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\spinbox.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\utils.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\button.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\menubutton.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\scrollbar.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\scale.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\progress.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\notebook.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\panedwindow.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\entry.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\combobox.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\spinbox.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\treeview.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\classicTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\altTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\clamTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\winTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\xpTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\vistaTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\bcd VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\boot.sdi VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\bootfix.bin VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\bootsect.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\memtest.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\en-gb VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\fonts VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\fonts\chs_boot.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\fonts\jpn_boot.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\fonts\malgun_boot.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\boot\fonts\segoe_slboot.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\efi\boot VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\efi\boot\bootx64.efi VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\efi\microsoft VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\efi\microsoft\boot VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\efi\microsoft\boot\fonts VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\efi\microsoft\boot\resources VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\appcompat_detailed_bidi_txt.xsl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\appcompat_detailed_txt.xsl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\setupplatform.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\setupprep.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sflcid.dat VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sflistrs1.dat VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sflistw8.woa.dat VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sflistwb.dat VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sflistwb.woa.dat VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sfpatw7.inf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sfpatw8.inf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sfpatwb.inf VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\wicadevicefilters.xml VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\accessibilitycpl-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\cryptoconfig-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\eventlog-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\explorer-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\microsoft-windows-wab-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\netfx-wcf-tcpportsharing-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\netfx4-wcf-client-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\netfx4clientcorecomp-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\rights-management-client-v1-api-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\rights-management-services-server-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\terminalservices-sessiondirectory-client-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\wcf-http-activation-postapply-dl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\microsoft-activedirectory-webservices-dl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\microsoft-windows-networkloadbalancing-core VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\dlmanifests\microsoft-windows-rasconnectionmanager VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\en-gb VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\en-gb\wimprovider.dll.mui VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\activedirectory-webservices-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\cloudapreplacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\directoryservices-administrativecenter-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\internet-naming-tools-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\ipv4ipv6coexistencemigration-net-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\kernel-pnp-repl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\kernel32-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\kernel32-server-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\mfmpeg2srcsnk-migration-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-activedirectory-powershell-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-certificateservices-ca-serverupgrade-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-certificateservices-ocsp-serverupgrade-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-onecore-tiledatarepository-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-windows-failovercluster-adminpak-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\printing-spooler-core-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\sounds-migration-replacement.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\srm-quotadriver-repl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\windows.cortana.desktop-repl.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\hwvid-migration-2 VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-activedirectory-webservices VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-client-license-platform-service-migration VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-windows-offlinefiles-core\en-gb VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-windows-rasapi-mig VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\microsoft-windows-shmig\en-gb VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\sppmig VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\replacementmanifests\wpc VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\sxs VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\uup VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\sources\uup\metadata VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: \Device\CdRom0\support\logging\microsoft-windows-actionqueue-instrumentation.man VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000 VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\Shell VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1 VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\CloudStore VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\Shell VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\CloudStore VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows\Shell VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\assignee.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\Program Files (x86)\Internet Explorer\iexplore.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\init.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\auto.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\tk.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\tm.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\package.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\pkgIndex.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\http1.0\pkgIndex.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tcl\opt0.4\pkgIndex.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\icons.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\button.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\entry.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\panedwindow.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\scale.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\spinbox.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\text.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\ttk.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\fonts.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\cursors.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\scrollbar.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\scale.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\progress.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\notebook.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\entry.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\combobox.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\treeview.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\sizegrip.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\classicTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\altTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\clamTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData\assignee\tk\ttk\winTheme.tcl VolumeInformation	Jump to behavior
Source: C:\ProgramData\assignee\assignee.exe	Queries volume information: C:\ProgramData VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_0100454A GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0100454A

Source: C:\ProgramData\assignee\assignee.exe

Code function: 4_2_6C9E16D0 Tcl_NewStringObj,Tcl_ObjSetVar2,TclFreeObj,GetVersionExA,GetSystemInfo,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,wsprintfA,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,Tcl_GetVar2,Tcl_GetVar2,Tcl_DStringAppend,Tcl_GetVar2,Tcl_DStringAppend,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,TclGetEnv,GetUserNameW,Tcl_ExternalToUtfDString,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,TclpFree,Tcl_NewStringObj,Tcl_SetVar2Ex,Tcl_GetString,

4_2_6C9E16D0

Source: C:\Users\user\Desktop\p2K.exe

Code function: 0_2_00FF03BE GetVersionExW,

0_2_00FF03BE

Source: C:\ProgramData\assignee\assignee.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7A8980 TkCreateMainWindow,Tcl_GetThreadData,Tcl_Panic,Tcl_Alloc,Tcl_InitHashTable,TkBindInit,TkFontPkgInit,TkStylePkgInit,Tcl_InitHashTable,Tcl_LinkVar,Tcl_ResetResult,Tcl_CreateNamespace,Tcl_ResetResult,Tcl_LinkVar,Tcl_ResetResult,Tcl_InitHashTable,Tk_SetAppName,Tk_GetUid,Tcl_IsSafe,Tcl_Panic,Tcl_CreateCommand,Tcl_CreateObjCommand,Tcl_HideCommand,Tcl_SetVar2,Tcl_SetVar2,	2_2_6C7A8980
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C852CC0 Tk_GetAllBindings,Tcl_NewObj,Tcl_ListObjAppendElement,Tcl_SetObjResult,	2_2_6C852CC0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7B1C80 TkTextMakeByteIndex,TkBTreeNumLines,TkTextMakeByteIndex,Tk_DeleteAllBindings,	2_2_6C7B1C80
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C852DB0 Tk_DeleteBinding,Tcl_ResetResult,Tcl_Panic,Tcl_Panic,Tcl_DeleteHashEntry,Tcl_Panic,Tcl_Free,Tcl_Free,	2_2_6C852DB0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C787D40 Tk_DeleteEventHandler,Tk_DeleteBindingTable,Tcl_Free,Tcl_DeleteHashTable,	2_2_6C787D40
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C82EDE0 Tcl_Alloc,Tk_BindEvent,Tcl_Free,	2_2_6C82EDE0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C831D00 Tcl_WrongNumArgs,Tcl_GetIndexFromObjStruct,Tcl_Preserve,Tcl_WrongNumArgs,Tcl_WrongNumArgs,Tcl_NewLongObj,Tcl_NewLongObj,Tcl_NewLongObj,Tcl_NewLongObj,Tcl_NewListObj,Tcl_SetObjResult,Tcl_WrongNumArgs,Tcl_GetString,Tcl_ObjPrintf,Tcl_SetObjResult,Tcl_GetString,Tcl_SetErrorCode,Tk_CreateBindingTable,Tcl_GetString,Tcl_GetString,Tk_DeleteBinding,Tcl_GetString,Tk_CreateBinding,Tcl_GetString,Tk_DeleteBinding,Tcl_NewStringObj,Tcl_SetObjResult,Tcl_SetErrorCode,Tcl_GetString,Tk_GetBinding,Tcl_GetObjResult,Tcl_GetString,Tcl_ResetResult,Tcl_NewStringObj,Tcl_SetObjResult,Tk_GetAllBindings,Tcl_Release,	2_2_6C831D00
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C852D60 Tk_GetBinding,	2_2_6C852D60
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C853E40 Tk_BindEvent,TkpGetKeySym,Tcl_DStringInit,Tcl_DStringAppend,Tcl_SaveInterpState,Tcl_Preserve,Tcl_AllowExceptions,Tcl_EvalEx,Tcl_AddErrorInfo,Tcl_BackgroundException,Tcl_RestoreInterpState,Tcl_DStringFree,Tcl_Release,	2_2_6C853E40
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C828E50 Tcl_WrongNumArgs,Tcl_GetString,Tk_NameToWindow,Tcl_NewObj,Tcl_NewStringObj,Tcl_ListObjAppendElement,Tcl_NewStringObj,Tcl_ListObjAppendElement,Tcl_NewStringObj,Tcl_ListObjAppendElement,Tcl_NewStringObj,Tcl_ListObjAppendElement,Tcl_NewStringObj,Tcl_ListObjAppendElement,Tcl_SetObjResult,TkFreeBindingTags,Tcl_ListObjGetElements,Tcl_Alloc,Tcl_GetString,Tcl_Alloc,Tk_GetUid,	2_2_6C828E50
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C852F50 Tk_CreateBinding,Tcl_Alloc,memcpy,memcpy,Tcl_Alloc,memcpy,Tcl_Free,	2_2_6C852F50
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C8288A0 TkFreeBindingTags,Tcl_Free,Tcl_Free,	2_2_6C8288A0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7A7930 Tk_DestroyWindow,Tcl_GetThreadData,Tcl_Alloc,TkFocusDeadWindow,Tk_DestroyWindow,TkpGetOtherWindow,Tk_DestroyWindow,Tk_MakeWindowExist,Tk_HandleEvent,Tcl_Free,Tcl_Panic,TkWmDeadWindow,TkWmRemoveFromColormapWindows,XDestroyWindow,Tcl_DeleteHashEntry,TkEventDeadWindow,TkFreeBindingTags,TkOptionDeadWindow,TkSelDeadWindow,TkGrabDeadWindow,Tcl_Free,Tk_DeleteAllBindings,Tcl_DeleteHashEntry,Tcl_InterpDeleted,Tcl_CreateCommand,Tcl_CreateCommand,Tcl_UnlinkVar,Tcl_UnlinkVar,Tcl_DeleteHashTable,Tcl_DeleteHashTable,TkBindFree,TkDeleteAllImages,TkFontPkgFree,TkFocusFree,TkStylePkgFree,XSync,Tcl_Free,Tcl_EventuallyFree,	2_2_6C7A7930
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C829930 TkBindEventProc,Tcl_Alloc,Tk_GetUid,Tk_BindEvent,Tcl_Free,	2_2_6C829930
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C81C960 Tk_HandleEvent,Tcl_GetThreadData,Tcl_Preserve,TkSelEventProc,Tk_InternAtom,TkWmProtocolEventProc,TkBindEventProc,Tcl_Release,	2_2_6C81C960
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7B1A50 Tcl_Alloc,Tk_BindEvent,Tcl_Free,	2_2_6C7B1A50
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C869AE0 TkpInitializeMenuBindings,Tk_GetUid,Tk_MainWindow,Tcl_CreateObjCommand,Tk_CreateBinding,Tk_CreateBinding,Tk_CreateBinding,Tk_CreateBinding,Tk_CreateBinding,Tk_CreateBinding,Tk_CreateBinding,Tk_CreateBinding,	2_2_6C869AE0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C786AB0 Tk_CreateOptionTable,Tk_CreateOptionTable,Tk_CreateOptionTable,Tk_CreateOptionTable,Tk_CreateBindingTable,Tk_CreateEventHandler,Tcl_InitHashTable,Tk_InitOptions,Tk_InitOptions,Tcl_InitHashTable,Tk_InitOptions,	2_2_6C786AB0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C8514A0 Tk_CreateBindingTable,Tcl_Alloc,Tcl_InitHashTable,Tcl_InitHashTable,	2_2_6C8514A0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7B2490 Tcl_WrongNumArgs,Tcl_GetIndexFromObjStruct,Tcl_WrongNumArgs,Tcl_GetString,Tk_OwnSelection,Tcl_WrongNumArgs,Tcl_GetString,Tk_CreateBindingTable,Tcl_GetString,Tcl_GetString,Tk_DeleteBinding,Tcl_GetString,Tk_CreateBinding,Tcl_GetString,Tk_DeleteBinding,Tcl_NewStringObj,Tcl_SetObjResult,Tcl_SetErrorCode,Tcl_GetString,Tk_GetBinding,Tcl_GetObjResult,Tcl_GetString,Tcl_ResetResult,Tcl_NewStringObj,Tcl_SetObjResult,Tk_GetAllBindings,	2_2_6C7B2490
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7855E0 Tcl_Preserve,Tk_BindEvent,Tcl_Release,	2_2_6C7855E0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C851540 TkBindFree,Tk_DeleteBindingTable,Tcl_EventuallyFree,	2_2_6C851540
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C830680 Tcl_Free,Tcl_Free,Tcl_DeleteHashTable,Tk_FreeGC,Tcl_DeleteTimerHandler,Tk_DeleteBindingTable,Tk_FreeOptions,Tcl_Free,	2_2_6C830680
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C8546C0 TkBindInit,Tcl_Panic,Tcl_MutexLock,Tcl_InitHashTable,Tcl_InitHashTable,Tcl_InitHashTable,Tcl_InitHashTable,Tcl_MutexUnlock,Tk_CreateBindingTable,Tcl_Alloc,TkpInitializeMenuBindings,	2_2_6C8546C0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C829700 Tcl_WrongNumArgs,Tcl_GetString,Tk_NameToWindow,Tk_GetUid,Tcl_GetString,Tcl_GetString,Tk_DeleteBinding,Tk_CreateBinding,Tcl_GetString,Tk_GetBinding,Tcl_ResetResult,Tcl_NewStringObj,Tcl_SetObjResult,Tk_GetAllBindings,	2_2_6C829700
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C785000 Tcl_WrongNumArgs,Tk_GetAllBindings,Tcl_GetString,Tk_GetBinding,Tcl_NewStringObj,Tcl_SetObjResult,Tcl_GetString,Tcl_GetString,Tk_DeleteBinding,Tk_CreateBinding,Tk_DeleteBinding,Tcl_ObjPrintf,Tcl_SetObjResult,Tcl_SetErrorCode,	2_2_6C785000
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C7CD0F0 Tcl_Free,Tcl_Free,Tcl_FirstHashEntry,Tcl_NextHashEntry,Tcl_FirstHashEntry,Tcl_NextHashEntry,Tcl_DeleteHashTable,Tcl_FirstHashEntry,Tcl_NextHashEntry,Tcl_Free,Tcl_DeleteHashTable,Tcl_DeleteHashTable,Tcl_DeleteHashTable,Tk_DeleteBindingTable,Tcl_Free,Tcl_Free,Tcl_DeleteTimerHandler,Tcl_DeleteCommandFromToken,Tcl_Free,	2_2_6C7CD0F0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C8512A0 Tk_DeleteAllBindings,Tcl_DeleteHashEntry,Tcl_Panic,Tcl_Free,Tcl_Free,Tcl_DeleteHashEntry,	2_2_6C8512A0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 2_2_6C8513C0 Tk_DeleteBindingTable,Tcl_FirstHashEntry,Tcl_NextHashEntry,Tcl_Free,Tcl_Free,Tcl_DeleteHashTable,Tcl_DeleteHashTable,Tcl_Free,	2_2_6C8513C0
Source: C:\ProgramData\assignee\assignee.exe	Code function: 4_2_6C9E7F20 TlsGetValue,Tcl_MutexLock,LeaveCriticalSection,socket,WSAGetLastError,TclWinConvertError,SetHandleInformation,TclSockMinimumBuffers,htons,bind,WSAGetLastError,TclWinConvertError,closesocket,getsockname,htons,listen,socket,WSAGetLastError,_errno,_errno,_errno,SetHandleInformation,TclSockMinimumBuffers,bind,WSAGetLastError,TclWinConvertError,ioctlsocket,WSAGetLastError,TclWinConvertError,connect,WSAGetLastError,TclWinConvertError,_errno,closesocket,freeaddrinfo,freeaddrinfo,ioctlsocket,SendMessageW,Tcl_PosixError,Tcl_ObjPrintf,Tcl_SetObjResult,closesocket,	4_2_6C9E7F20

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	35 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
C:\ProgramData\assignee\Cryptodome\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_Salsa20.pyd	0%	Virustotal	Browse
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd	1%	Virustotal	Browse
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd	0%	Virustotal	Browse
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Hash\_MD5.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Hash\_SHA1.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Hash\_SHA256.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\ProgramData\assignee\Cryptodome\Util\_strxor.pyd	0%	ReversingLabs
C:\ProgramData\assignee\_ctypes.pyd	0%	ReversingLabs
C:\ProgramData\assignee\_socket.pyd	0%	ReversingLabs
C:\ProgramData\assignee\_ssl.pyd	0%	ReversingLabs
C:\ProgramData\assignee\_tkinter.pyd	0%	ReversingLabs
C:\ProgramData\assignee\msvcr100.dll	0%	ReversingLabs
C:\ProgramData\assignee\psutil\_psutil_windows.pyd	0%	ReversingLabs
C:\ProgramData\assignee\python34.dll	0%	ReversingLabs
C:\ProgramData\assignee\pywintypes34.dll	0%	ReversingLabs
C:\ProgramData\assignee\tcl86t.dll	0%	ReversingLabs
C:\ProgramData\assignee\tk86t.dll	0%	ReversingLabs
C:\ProgramData\assignee\unicodedata.pyd	0%	ReversingLabs
C:\ProgramData\assignee\win32api.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://nuitka.net/info/segfault.html	0%	Virustotal		Browse
http://creativecommons.org/ns#CommercialUse	0%	Virustotal		Browse
http://xml.org/sax/features/external-general-entities	0%	Virustotal		Browse
http://xml.org/sax/features/namespaces	0%	Virustotal		Browse
http://www.inkscape.org/)	0%	Virustotal		Browse
http://python.org/dev/peps/pep-0263/	0%	Virustotal		Browse
http://xml.org/sax/features/string-interningz&http://xml.org/sax/features/validationz5http://xml.org	0%	Virustotal		Browse
http://creativecommons.org/licenses/by-nc-sa/3.0/	0%	Virustotal		Browse
http://creativecommons.org/ns#ShareAlike	0%	Virustotal		Browse
http://www.inria.fr/koala/colas/mouse-wheel-scroll/	0%	Virustotal		Browse
https://github.com/pypa/packagingz	0%	Virustotal		Browse
https://nuitka.net/info/segfault.htmlfor	0%	Virustotal		Browse
http://creativecommons.org/licenses/by-sa/3.0/)	2%	Virustotal		Browse
http://xml.org/sax/features/string-interning	0%	Virustotal		Browse
http://pywin32.sourceforge.net	0%	Virustotal		Browse
https://pypi.org/project/segno/	0%	Virustotal		Browse
http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml)-r)	1%	Virustotal		Browse
http://creativecommons.org/ns#DerivativeWorks	0%	Virustotal		Browse
http://xml.org/sax/features/external-parameter-entities	0%	Virustotal		Browse
http://xml.org/sax/features/namespace-prefixes	0%	Virustotal		Browse
http://tango.freedesktop.org/Tango_Desktop_Project	0%	Virustotal		Browse
http://creativecommons.org/ns#	0%	Virustotal		Browse
http://xml.org/sax/properties/dom-node	0%	Virustotal		Browse
http://xml.org/sax/properties/xml-string	0%	Virustotal		Browse
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	0%	Virustotal		Browse
http://creativecommons.org/ns#Distribution	0%	Virustotal		Browse
http://www.openssl.org/support/faq.html....................	0%	Virustotal		Browse
http://creativecommons.org/ns#Attribution	0%	Virustotal		Browse
http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz	0%	Virustotal		Browse
http://www.python.org/sax/properties/encoding	0%	Virustotal		Browse
http://xml.org/sax/properties/declaration-handler	0%	Virustotal		Browse
http://xml.org/sax/features/validation	0%	Virustotal		Browse
http://curl.haxx.se/rfc/cookie_spec.html	0%	Virustotal		Browse
http://creativecommons.org/ns#Reproduction	0%	Virustotal		Browse
http://creativecommons.org/ns#Notice	0%	Virustotal		Browse
http://www.inkscape.org/namespaces/inkscape	0%	Virustotal		Browse
https://blockchain.info/q/getreceivedbyaddress/	0%	Virustotal		Browse
http://www.python.org/sax/properties/interning-dict	0%	Virustotal		Browse
http://xml.org/sax/properties/lexical-handler	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://python.org/dev/peps/pep-0263/	assignee.exe, 00000002.00000002.3370875187.000000006CCFE000.00000002.00000001.01000000.0000000B.sdmp	false	0%, Virustotal, Browse	unknown
https://nuitka.net/info/segfault.html	assignee.exe, assignee.exe, 00000004.00000002.2311024840.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/features/external-general-entities	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#CommercialUse	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.inkscape.org/)	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/features/namespaces	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/features/string-interningz&http://xml.org/sax/features/validationz5http://xml.org	assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/licenses/by-nc-sa/3.0/	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#ShareAlike	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.inria.fr/koala/colas/mouse-wheel-scroll/	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/features/namespace-prefixes	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/pypa/packagingz	p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
https://nuitka.net/info/segfault.htmlfor	p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000000.2184489626.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000002.2311024840.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/licenses/by-sa/3.0/)	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://xml.org/sax/features/string-interning	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/features/external-parameter-entities	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml)-r)	assignee.exe, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	1%, Virustotal, Browse	unknown
https://pypi.org/project/segno/	assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://www.openssl.org/support/faq.html	p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp	false	URL Reputation: safe	unknown
http://pywin32.sourceforge.net	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369889725.000000006CA88000.00000002.00000001.01000000.00000020.sdmp, assignee.exe, 00000004.00000002.2316308925.000000006CA88000.00000002.00000001.01000000.00000020.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#DerivativeWorks	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://tango.freedesktop.org/Tango_Desktop_Project	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/properties/dom-node	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.python.org/sax/properties/encoding	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/properties/xml-string	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#Distribution	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz	assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/properties/declaration-handler	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.openssl.org/support/faq.html....................	p2K.exe, 00000000.00000003.2176583196.0000000007F09000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3371772116.000000006D440000.00000002.00000001.01000000.00000026.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#Attribution	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	URL Reputation: safe	unknown
http://xml.org/sax/features/validation	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.python.org/sax/properties/interning-dict	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pywin32.sourceforge.net0	p2K.exe, 00000000.00000003.2176583196.00000000077DE000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3369781184.000000006CA6A000.00000002.00000001.01000000.00000021.sdmp	false		unknown
http://curl.haxx.se/rfc/cookie_spec.html	p2K.exe, 00000000.00000003.2176583196.0000000006A62000.00000004.00000020.00020000.00000000.sdmp, assignee.exe, 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp, assignee.exe, 00000004.00000000.2293523758.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#Notice	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://creativecommons.org/ns#Reproduction	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://blockchain.info/q/getreceivedbyaddress/	assignee.exe, 00000002.00000002.3367817874.00000000042F0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.inkscape.org/namespaces/inkscape	p2K.exe, 00000000.00000003.2176583196.0000000007FF6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://xml.org/sax/properties/lexical-handlerz1http://xml.org/sax/properties/declaration-handlerz&ht	assignee.exe	false		unknown
https://shapeshift.banxa.com?coinAmount=0.00196201&coinType=BTC&walletAddress=bc1qmz279qhl6dumwfqccd	assignee.exe, 00000002.00000002.3367898833.0000000004370000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313737655.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/properties/lexical-handler	assignee.exe, 00000002.00000002.3368055604.0000000004430000.00000004.00001000.00020000.00000000.sdmp, assignee.exe, 00000004.00000002.2313916217.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521694
Start date and time:	2024-09-29 02:17:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	p2K.exe
Detection:	SUS
Classification:	sus35.winEXE@4/932@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 150 Number of non-executed functions: 192
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:18:24	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\assignee.lnk

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.580931442084257
Encrypted:	false
SSDEEP:	96:mwAhuIpykTcor4JyBcx+u6eE1SgvovmGfWcOlNJ3b8/VM3X7PVAAD6MMtHU:mwAukTcJyBcmemzVhL8/S3X7PVlD6
MD5:	04031D0D3AC9759A911EC58C906C9485
SHA1:	64DBBB7788B6461BA1178116F573AD435B43DD78
SHA-256:	714ADF2194C5D9EEF3B070AD78F2F3D7DD6F5FA50BDE5451134EA886BF8F529B
SHA-512:	852589E3ECDF1399BCA813A54BACD07DBA8FC8FA6C0DA922888238F91E2ED2B9EB55558B687F2AF808A6EC96DB60300E17F9566B0E739EA3D1DB43D499FA8290
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.@...@...@...Ix..B...[...C...@..._...[...A...[./.B...[...M...[...A...[...A...Rich@...........PE..L...[..]...........!.........................0...............................`............@..........................4.......1..<............................P..0....................................0..@............0...............................text............................... ..`.rdata..x....0......................@..@.data........@......................@....reloc..h....P......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.866386592993704
Encrypted:	false
SSDEEP:	384:r03InCXbQ8xag9T1eibllfr924bVS37usOo8Vd6IHiPKDkAKB5F0CrPVlCzPQ:6FZrA4bV2ahoICS4AITrdT
MD5:	2B734276CE8956A384024ADE7E553E52
SHA1:	906852B7F5F01B8ABF07D052F8875BF734082250
SHA-256:	F562B2DB87FFD6796B2427F40A675F9B2738FD2F00E5F681ABB38B4E74DE4BF0
SHA-512:	94DC48AFDB7C81798C60414E0A19B6D9C051E42D1F0EA87F4FDAE18080B4349BD1AE9047F0E53BD4C9B0D8048198C995B895AEE1676E98C12FF2992B49A8DDF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.@...@...@...Ix..B...[...C...@..._...[...A...[./.B...[...M...[...A...[...A...Rich@...........PE..L...Y..]...........!.....6...8.......>.......P............................................@..........................\|.......y..<...............................P....................................x..@............P...............................text....4.......6.................. ..`.rdata..J-...P.......:..............@..@.data................h..............@....reloc...............j..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.606425517897381
Encrypted:	false
SSDEEP:	192:Qzets9ykU/sze/6TimqYMpJSGkURUl3X7PVlD6DQYUWl0:QAB/96TidpJgrPVlpYUWq
MD5:	BC52D438E25334A6C66232690C0BCE3E
SHA1:	288CF74D9F3626855C60A30965AF5FFBF31288A3
SHA-256:	080177EECEFCD75925FF130BDF22A2FC117081D3E3CECF9D81EADD505BE3207B
SHA-512:	4D9D0BF6894FB25C0247FD083C561C7B33BFBED0B0C1C6DEBC15F7C5065EABF8EA0C1E1AE67AE2D364EECCCCD41FF68D39A2CDE2016F1940FEBB9CF9ECB2D973
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...b...[...A...[.,.B...[.-.M...[...A...[...A...Rich@...................PE..L...Z..]...........!.........................0...............................`............@..........................5.......1..<............................P.......................................0..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@....... ..............@....reloc.......P......."..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.076361013105295
Encrypted:	false
SSDEEP:	96:/6eopJOEk3woPeGofKFXvB0qMO0GJ3X7PVAAD6xti7:/6eopJODBh55MFGJ3X7PVlD6PQ
MD5:	0905C11EB2A12A9B90C2A33AC0590C99
SHA1:	D1EB025510A85C2100029579EBB7B78B9DB48D9F
SHA-256:	87A59DCFA41A187F3A9F1081F107A952CA3E6DA908E731D41F81208538A1267A
SHA-512:	A9B4DC4E65DEF79914B633AC2E011B7C07888195ED171F5C0B2543AC3F7D14F86022DC2BCD398F246B1F797E844CCC31131DF271189D248F4CDFDF8B84D8A26C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...`...[...A...[./.B...[...M...[...A...[...A...Rich@...................PE..L...[..]...........!......................... ...............................P............@..........................$......\|!..<............................@..(.................................... ..@............ ...............................text...4........................... ..`.rdata..f.... ......................@..@.data...`....0......................@....reloc..\....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.285437306958703
Encrypted:	false
SSDEEP:	96:nLFKTcuNoioloE6A5asC2b/bp+3X7PVAAD6+nKVhG:L43NofmICS+3X7PVlD6cK6
MD5:	4AB7F26C7B0210CE9D00EAC86901FDC4
SHA1:	5800EA99427BFFC797A94408CDEEB59BA62EE571
SHA-256:	FFBD4EA8E2F0505587611999BF31C7B1A79E1FCFE1FFE3B1D51EF7C36A5D5D0B
SHA-512:	2D1FCACDCA17909ABB63C59BC728B9923DA398737C3E3324C9A22762B79A7A5B5D34F02D2DFDABC7EAC9F239F597EF821270350BC237F6B9C3B03CB243610B4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...b...[...A...[.,.B...[.-.M...[...A...[...A...Rich@...................PE..L...[..]...........!................X........ ...............................P............@..........................$......\|!..<............................@..8.................................... ..@............ ...............................text...t........................... ..`.rdata....... ......................@..@.data...P....0......................@....reloc..r....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	5.295938278944844
Encrypted:	false
SSDEEP:	192:eNd5J4+8WE44wZgn0qDOWDj3X7PVlD6MK+K2OFT:fJKSn8OrPVlsF2
MD5:	BAD784233AA60C4755F95AB7D23C641D
SHA1:	59AB29E26038B9293DCC3720E5938D6D48379CBB
SHA-256:	5F6CF650942C17E0DAF840A1D58E72C91B8B99E33B1AE6B49ED954869495E7B8
SHA-512:	682A990B2B695BD291FF0901C93338F028223B16FF57BABE5AC7F99BAA8B8C7F5A536AE6778303D82777F97D01A4AE73A83454F5D12D01CC54F8717DEBED7AA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..v...v...v.....[.t...m'T.u...v...U...m'V.t...m'c.t...m'b.{...m'S.w...m'U.w...Richv...................PE..L...[..]...........!......................... ...............................P............@..........................$......\|!..<............................@..D.................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.852913431528159
Encrypted:	false
SSDEEP:	96:FnpjoqJOBcFyOvobXvB0qMWJm1Y3XLPVAAD6yEO7Z:FnpjoqJOBcoSS5ME3XLPVlD6u
MD5:	1F32980125B2A22F871060FF3277F438
SHA1:	993D64EFF01460FB17E96FCDEC0AAD1634E0CFFA
SHA-256:	B9754C3229F56F9019AAF3F151DF6C7B4FD0E792E8A407DBDD434FD710A6E972
SHA-512:	62A994B413532E7662BF35003FBB7954063C2549356C060A96FDCA275B99BD3706DCD9E1327E33060285A073ABC2D1B910FE48643AAE0A21C8319DCEEF0A76B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[]..C...@...^...[]..A...[](.B...[]).M...[]..A...[]..A...Rich@...................PE..L...[..]...........!................(........ ...............................P............@..........................$......l!..<............................@.. .................................... ..@............ ...............................text...D........................... ..`.rdata..6.... ......................@..@.data...`....0......................@....reloc..T....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	6.743516077342589
Encrypted:	false
SSDEEP:	192:p288h7faRC6mJyeQ8cHJAyZJg8D0KThxA+rAQE+tnJiO8O3X7PVlD68I6:psa1LpJgLa0Mp8SrPVl3I
MD5:	AE457B1E4E2EA8817BAD37F9786487B9
SHA1:	88C847BFB6F84BBEBD97356D6C83FFF1471594A4
SHA-256:	F6BCB192237D8A9ED02C5C305AC858C4561C267FD238060BAB7C415DF2067569
SHA-512:	E172DFFB2C6047CBE207E294FE2D1B4B016E93B6F7A8C5E29CD2CB45C06D204E6F42C0EE028B7BB9EA85669A7669C8CED4017788F817DBD18C9BF4B4B492B904
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...`...[...A...[./.B...[...M...[...A...[...A...Rich@...................PE..L...Z..]...........!.........................0...............................p............@..........................D.......A..<............................`..D....................................@..@............0...............................text...T........................... ..`.rdata.......0......................@..@.data........P......................@....reloc..z....`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.506977437733713
Encrypted:	false
SSDEEP:	192:I6eZSEGTwmmjAo21BtXCvpVlkU3X7PVlD6defrU:Ne8rt4Azrtyvp3frPVlt
MD5:	8C626D45AADE98EA2E076B95CE567117
SHA1:	AB557D765A31F80560712CB044077D8AE806803B
SHA-256:	EDDFA6BAE110251B7F67E654A20699448D9F45E3D235F4BEFF22B13A774AFC9A
SHA-512:	00B36937AFB577905412ACA62CC841F6E3501B58A3BB67008EADD5E4B869A4D64D3912FD68A9314A4684799E3C3769B5D4D80B5A43CA9C42B2310D04923A8BFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...a...[...A...[...B...[./.M...[...A...[...A...Rich@...........PE..L...[..]...........!.........................0...............................`............@..........................4......\|1..<............................P..4....................................0..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....reloc..n....P......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.857962389109081
Encrypted:	false
SSDEEP:	96:mYS4FpJOEk3woPeGoKTKXvB0qMO0CtJ3X7PVAAD63acszr:mvupJODBhW5MFCtJ3X7PVlD6qpP
MD5:	D7CFB3AF228F99240FC92071F175E2A6
SHA1:	2B68FB8779FB3DCF27CD4AAF02551F49CFAC8910
SHA-256:	4FFD5F65E06D786B84F0F9DCA31758728E755A7945563EE441B87F5C176E8D0C
SHA-512:	623505334EFF58D6B42E42516CC71C75CDAE07DFCD8E46D4F5A196D379A818167C7205782CFF65D8F8F8C39F3BECFBDBEE59A201E0EB34E88B22460401A60297
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...`...[...A...[./.B...[...M...[...A...[...A...Rich@...................PE..L...[..]...........!................*........ ...............................P............@..........................$......\|!..<............................@..(.................................... ..@............ ...............................text...D........................... ..`.rdata..f.... ......................@..@.data...`....0......................@....reloc..\....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.570536337328874
Encrypted:	false
SSDEEP:	192:I3wPRZsHxwjzm/ZfEa3X7PVlD6ldlDdh:CwpZsHxOS/ZfprPVlyd
MD5:	46C347C7EA91F91DF0D6D686D1D792A2
SHA1:	A71B7E757E660A47E49093D0E413457EBB644159
SHA-256:	2A577E204E7D6E8EA95B2A93CAB096A200FF177A4001841AD14C79D269AA3405
SHA-512:	DE03FBDC757824A1C51A4EC3A163AF002A9646DB8BB68C547EA140AD2530B75168D5B4CB19A0A0DC5578236E8208D63644A300BA453CC257A6BA56C41846F5E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...a...[...A...[...B...[./.M...[...A...[...A...Rich@...........PE..L...Y..]...........!.........................0...............................`............@..........................5......\2..<............................P..4....................................1..@............0...............................text............................... ..`.rdata..i....0......................@..@.data........@......................@....reloc..j....P....... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.7593464831207095
Encrypted:	false
SSDEEP:	192:h3+Ph0gucIrsfdB8d1JGS1Hi3X7PVlD6WvNkR:t+Vu1s1MGdrPVllv
MD5:	AF0492B99DB52804475D022B7C4F9DAC
SHA1:	747F9522AB5C0063FBB930735EBAF477CB13E2D0
SHA-256:	6BA02C1C90BDFD9D4B237B09A0E0DE562F0D374CB060516AE227827313C00911
SHA-512:	20C430567887FA4BCDE34E5DE8B9D27AD8AF417C32CB4D3BA58CEF43BA29E1A9A298D1625ACCCF69A191B855B2E792DBD7A923FA841EB2D6FB1B5EBE6BC3B9A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...b...[...A...[.,.B...[.-.M...[...A...[...A...Rich@...................PE..L...V..]...........!.........................0...............................`............@..........................4......\|1..<............................P..@....................................0..@............0...............................text............................... ..`.rdata.......0......................@..@.data...P....@....... ..............@....reloc..v....P......."..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.989548214748203
Encrypted:	false
SSDEEP:	384:6Q5QKHgJAI5BrrMPXZyg1Ak/od+cH7QrPVlr+:HQKHgy+B8PrqkQccH7Qrdx+
MD5:	3A73556BC2D95E02A3B58298E0E56885
SHA1:	2E452EDE8DEC28785BE8B7A194AFA7CF01C5B4C8
SHA-256:	0904ABE86E0497D9B5008E0C88E730B6C1A66F4DCAB8BB6AF3E19BD065CFFE21
SHA-512:	652872FEDC91CE3FFF8CCCADD169C24447C4A06392658E74F962A0909EEEB3A9599617FB95C7F3C4D1B8AF36D63EB1E2172C991D2785D6580E4723292430CB35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..v...v...v.....W.t...m'X.u...v...T...m'Z.t...m'o.t...m'n.{...m'_.w...m'Y.w...Richv...........................PE..L...V..]...........!.....&.........../.......@...............................p............@..........................D......\|A..<............................`..@....................................@..@............@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data...`....P.......0..............@....reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	6.156033433570131
Encrypted:	false
SSDEEP:	384:gC1tkft7WQZjAplIF7ZDo1Kc7wrcH0TrPVlqQ:B0jeUtob7wrcH0TrdAQ
MD5:	06BADEF66E6B5FEC7B7F4F4A4B09E25A
SHA1:	F2FC62D91FEA59D2A3D810332848E964619E1371
SHA-256:	B0982704B3C397AA21E32DEEBD2880FFB05A0516E794D86EBEE1E94B1D670A03
SHA-512:	B6CD1FF056151D53CA3063740985CF8F6BD0A7EC2D76D4B4AA272FB44D0A239981C935716871FF3F97AAAE1EF84C492006FBAC491DFA3200AC375ACF2AAF1EB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...b...[...A...[.,.B...[.-.M...[...A...[...A...Rich@...................PE..L...V..]...........!................3.......@...............................p............@..........................E.......B..<............................`..8....................................A..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...`....P.......6..............@....reloc..z....`.......8..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	5.23475498305592
Encrypted:	false
SSDEEP:	192:OzViRlp27Ai3juZJOnnq5M83X7PVlD6l:Ozm/27l3SfKnibrPVly
MD5:	B26FACE01BE90261BF2A9F7B6101CD3A
SHA1:	A9405E898BA4D099B7118A2F94C874505E28088C
SHA-256:	05FB10F249528A5D0B2E31399C0124D54B81FF90B50C5A5D6861E253C3A710BF
SHA-512:	6EB0C3265BD85C188FF62C09D78DC942C478D027443EC3360CA49F13FEC0C08AAF7A44B55C849BCBC816AF34060C9B5731D262E4C3D3F1F0061A74EED8970675
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...`...[...A...[./.B...[...M...[...A...[...A...Rich@...................PE..L...Y..]...........!................b........ ...............................P............@..........................$.......!..<............................@..4.................................... ..@............ ...............................text............................... ..`.rdata..x.... ......................@..@.data...`....0......................@....reloc..l....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	5.519792364589022
Encrypted:	false
SSDEEP:	192:xKNZ4WnPK3E6EEEEECE13XWRpV6MV3BX3X7PVlD61rRm:ofbnjJffR12ncI3BHrPVla
MD5:	94B8495888B7AD9393972C48903A7A1A
SHA1:	C402B938CA4934514A462D13E2D662F3883A52B6
SHA-256:	DB02BA9E593B1211CDFE0AB334F7EE9AA97E098FFE1D8165CC5F1BCAA0E6D71B
SHA-512:	70EB69B6ADF12457477E6C500EBD1A5636CDA934BBA3678C5CE6AA258A5B43DB60F6D3E213766D1784F67ED807DA37A50144D89827B0E4C879EBE71F7EB26E24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OR...<...<...<..V....<.......<...=...<.......<.......<.......<.......<.......<.Rich..<.........PE..L...Y..]...........!................4........ ...............................P............@..........................$......\|!..<............................@..(.................................... ..@............ ...............................text...T........................... ..`.rdata..g.... ......................@..@.data........0......................@....reloc..\....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.042847201732579
Encrypted:	false
SSDEEP:	96:1aQ/ffBvlQpviDzwKL1W7alB7T3u3X7PVAAD6xtNv5W35:I+fBepvOvWWlB7T3u3X7PVlD64
MD5:	4A9B5C67AAC586800DE1C0B4CEBD8A73
SHA1:	FE2F03DAE234A435C467E9F3B171FC685977F39C
SHA-256:	D535677C93D13A528A170FD3E992D16A4628684BC41B95248A5F242DD7742D6B
SHA-512:	639F6591E783D9FAEB691F9E384570F076A7057B15749F4D150CE6E6152718BC213F1F19221AF62A209E5675E5E7772B9D82ABF82B2173381C88F34D83CD6458
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[...C...@...a...[...A...[...B...[./.M...[...A...[...A...Rich@...........PE..L...[..]...........!......................... ...............................P............@..........................$..c...\|!..<............................@..0.................................... ..@............ ...............................text............................... ..`.rdata..#.... ......................@..@.data........0......................@....reloc..h....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.817164953212927
Encrypted:	false
SSDEEP:	96:Fnp9DNDjDcwWJOKvsZv4rXvB0qMWJp51Y3XLPVAAD6ArY+:FnpwwWJOKUhS5MWE3XLPVlD68Y+
MD5:	7E8CB1638AC94C3294335AD7D63963EE
SHA1:	D50EE7710C277E6FBB8844446B2070E46E3C5A55
SHA-256:	981A4B4E2C393993D6E9386D3D805397C34F527423BC1674F0C89CE6D072EDB2
SHA-512:	773988F31442DFEF5AE4CE5135ED581778773716A627B8509E2D8EEC49C2EFC65F204D0497B0C428AFE493B69AB35D2AAD08DB5D38FA9EFB8C2916D39A1FCE3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[]..C...@...^...[]..A...[](.B...[]).M...[]..A...[]..A...Rich@...................PE..L...Z..]...........!................;........ ...............................P............@..........................$..z...l!..<............................@.. .................................... ..@............ ...............................text...T........................... ..`.rdata....... ......................@..@.data...`....0......................@....reloc..T....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\Cryptodome\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.733952244971667
Encrypted:	false
SSDEEP:	96:FnpOzewKJOVq6nvJQXvB0qMWJ01Y3XLPVAAD6mbf:FnpLwKJOVFvc5Me3XLPVlD6
MD5:	AF7BC7523291529438CC9A6852F7328B
SHA1:	0419BC7DBF62F69ABC83568FE810C676646B96C7
SHA-256:	149C711838A60CF7ACF7F4C770D7B68FA594E9E42BA14F2594D59FB2245DA2D7
SHA-512:	D781DB4986714DCE01C57F2E8E9128A6629430F7B6403101232740090068CCD924E6B8D2078EBF9149D9D384A6AA38A308AF88E025227FC8D38D4BF66B02DCB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@...@...@...I...B...[]..C...@...^...[]..A...[](.B...[]).M...[]..A...[]..A...Rich@...................PE..L...\..]...........!......................... ...............................P............@..........................$..q...l!..<............................@.. .................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....reloc..T....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.536370052377606
Encrypted:	false
SSDEEP:	1536:Oo5A1EQ38XUL9c+mCvqM8SQMkN/E+yJipQo4AFAr4kRhH:OhDo4wO32/JyUpnFGMAhH
MD5:	5D1BC1BE2F02B4A2890E921AF15190D2
SHA1:	057C88438B40CD8E73554274171341244F107139
SHA-256:	97C3CDEF6D28AD19C0DACFF15DD66F874FE73C8767D88F3BC7C0BDE794D857DA
SHA-512:	9751F471312DD5A24F4A7F25B192DDCB64D28A332FF66F3AA2C3F7EF69127CF14C93043350397E9F884F1830F51D5E01214E82627158D37EF95CE4746A83BBD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~n..~n..~n......~n......~n......~n......~n......~n......~n..~o..~n......~n......~n......~n.Rich.~n.........................PE..L...W.vV...........!.........z............................................................@.........................@/..........x............................`..........................................@...............`............................text............................... ..`.rdata...?.......@..................@..@.data...."...0... ..................@....reloc.. ....`.......8..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.443820605104129
Encrypted:	false
SSDEEP:	768:wh5oRXl9g8DnLwNruZWQbTGyRLkndosYlCrXMjYT7S0Cy:whmRxDLCELRLkiHkr4YTGFy
MD5:	EBC931925D333427E182EB58EB4CECCE
SHA1:	90A811FA23C1EA1244EDDEF5F3371411AF354FD6
SHA-256:	E29CC2340A9577F82C45ABE6707E2817575EE02AC374F4864885410D411E6BEA
SHA-512:	52767F0E49A600AB6B025265CD0220DFD84C24CCEC24F7268974123CAD41A287A015021357EC4B88EAE0DC0DD2517BB5D07F1AAAF08FD36E7BEDD0FAB8047AB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..P.s...s...s.......s....4..s....5..s.......s...s...s.......s....0..s.......s.......s..Rich.s..........PE..L...F.vV...........!.....V...`.......^.......p............................................@.............................M.......d...............................,....r..................................@............p..d............................text....U.......V.................. ..`.rdata..-"...p...$...Z..............@..@.data...l/...........~..............@....reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1331200
Entropy (8bit):	6.769741329219818
Encrypted:	false
SSDEEP:	24576:wQUJ1CWw45GYnwZxxImdLzDm+KpPL9LUXbLPiIcR0+ej/Fdp/MHPSCK2T:G1CWwEwvZLnSDMqIejw/Dp/OK2T
MD5:	12B5156DD0E8DE73B6C96DC61729CBBD
SHA1:	126903AC9E8447D52745782A14CD95818C048A53
SHA-256:	7A622E57F85120CEFE38F473E57B7363C8AFC551A35A6E4A4677B05F5D43881B
SHA-512:	1C2DB35190861237259F1761C4C24BECAAE1C3A525EBB70DD9E68B1BE5B16EDEB3D1EBAD6E710B0880448CF4F6F4C72A37926D584FC034956A91E1600EF3F335
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iM...#..#..#....#....#....#..#..#...K.#..".v.#.p...#....#....#....#.Rich..#.........................PE..L...k.vV...........!................'.....................................................@.........................p...G.......................................@.......................................@............................................text...N........................... ..`.rdata..............................@..@.data...............................@....reloc..8...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\_tkinter.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.385451678887325
Encrypted:	false
SSDEEP:	768:vEvQ/kxOL40PA5rZjXhaJD4lI0rTq83NPuwlVn+oq:vEikcL40I1ZjXUJD4i0Pq8dGwjTq
MD5:	9F720D0B8E8D9127424CAC562347352E
SHA1:	7D45D16E0583BAB8D798BFAD1532C997E0491805
SHA-256:	67609893AE2F90A0DD99262C25526E7EC93AAAA26856C2CD37AFCA34EF41AE8E
SHA-512:	83A15F5214491F68F15B2274DE76BCF5C4DC8862FE07368C812B095E7F83113FC16954961398740D02201BED6F42069FA45D4740C059CF368FC063582A673A87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4s..U.\.U.\.U.\..\.U.\..\.U.\..\.U.\..\.U.\.-.\.U.\.#.\.U.\.U.\2U.\..\.U.\..\.U.\..\.U.\Rich.U.\........................PE..L...b.vV...........!.....X...6......1b.......p............................................@.............................O....\|..x...............................`... s...............................{..@............p...............................text....W.......X.................. ..`.rdata..O....p... ...\..............@..@.data................\|..............@....reloc..t...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\assignee.exe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10840576
Entropy (8bit):	6.2665373628101655
Encrypted:	false
SSDEEP:	98304:EdaIWAWTbtZKtJ0oPvKBO5oCEnw7sIVy7h9bFGHe9ryXUJ/jv/mOZKik/O1RFX/+:E8Vn6VycHsvqeSeC/hENtNdP+0FqdMe
MD5:	DA4E8EBC459D4E4FA60C17B7E25ECBB4
SHA1:	DFB63B7C268416B4EF3AF19266F030175B8EE7F2
SHA-256:	361896440DACDDA1D0DD0C405F9D8B1F87C4C113297F0C697E729B2979D17F8A
SHA-512:	01B4FD43830BB5E47CD1C84878B418460B5B631A7FA1670D42481C6541221B4B6FA622ACD9023B08655C15B83E11EE8B88ADE95E59BDA56BE40CFE49EDF6D4B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..f...............)..a..f...,............a...@..................................4j...@..@K...............................f..+....f...;.....................%..........................D.b.......................f..............................text.....a.......a.................`..`.data....5....a..6....a.............@....rdata........b.......a.............@..@.eh_fram\|1...0c..2....c.............@..@.bss.....+...pe..........................idata...+....f..,...<e.............@....CRT....0.....f......he.............@....tls..........f......je.............@....rsrc.....;...f...;..le.............@..@.reloc...%......&...D..............@..B................................................................................................................................................................................................................................

C:\ProgramData\assignee\msvcr100.dll

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	6.435954205432799
Encrypted:	false
SSDEEP:	1536:Lgp1L90OahZK6IHBata/SFLtvQOHp80G/aMCtThbydG4/:Lgp1LKOahZK6Ihata/SFLtvQOHpP0aMj
MD5:	12E81FD47EA3D946EE5C093022811800
SHA1:	4DC27D92CF41C8E39BC3E2D5513E2D4D7EE6A144
SHA-256:	138B2B5418914792A2F287FE530094AD7E005841D57DA6A40D6E74E9B8422FC0
SHA-512:	BA64FFC12423583C7638C2C768A9E2C377D981EF0AD7A7064D56844871954AE6079BAFF671894425C2C6547AE9B9312841A0FC65165829EC641856497C7599DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c)S..zS..zS..zHZ.zW..zHZ.zQ..zHZ.zW..zZ..zB..zS..z...zHZ.z@..zHZ.zR..zHZ.zR..zRichS..z................PE..L....L.[...........!.....z...J......T.....................................................@.........................0...]...,...................................X...................................`...@............................................text...ty.......z.................. ..`.rdata...............~..............@..@.data...."....... ..................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\python34.dll

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2744320
Entropy (8bit):	6.654586601961673
Encrypted:	false
SSDEEP:	49152:ILFTVWvNvZoHK61aJYuC2TboWADOjUfZpTeCIVlHP2nmMbUPEbV1b3ijYbh:UgJRHgOjfrjHumMb1hsjYl
MD5:	068A2D61282B8C110CD652BFDF99C95F
SHA1:	62B6F9A66F168E3A001F5B80EF686339BFBDB102
SHA-256:	FDCB5F85B9FA3BEDCC9B2A999E8BD733412B60D9E5F9FAA9D1A5858AE753F3C4
SHA-512:	B85BB977973517FC3A083892A4207D7F3ADCD1E122C50E8327208FBCD7C9E95E2E6EF4C40A6D789A9EE441E97AB020EE4AE861CABD73E9E99C4BC64432233930
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L.{...{...{...5?..{....;..{....9..{.......{....4..{...{...z......5{....<..{....=..{....:..{..Rich.{..................PE..L...B.vV...........!................)..............................................-....@...........................!.....,.!.x....@)......................P)..6..p.................................!.@...............P............................text............................... ..`.rdata..............................@..@.data........."......x".............@....rsrc........@).......(.............@..@.reloc.. A...P)..B....(.............@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\pywintypes34.dll

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.496955925910133
Encrypted:	false
SSDEEP:	3072:niT41cG1ikjj6bCpQQpY7bi0Ik70c6Q0OfKf1IdtN2:nS46G1ikH6KpY7bi0z70FQ0OfKf1I
MD5:	38A5449BA521C43B3A4106FD5FCB468D
SHA1:	02C638333A9889DA428C65A7BDE39F131284F9D2
SHA-256:	0F0B6D9B0F9BEBF5405BABC569234890BB2015C1AD2C1E78D8D2D4A67C7D8FD3
SHA-512:	78B4178C26C89B579B104F4C5EE0D57CF8017953AB4C31272B77146D4CB10305C78358FF7DD40A1C33A2E548D4709DD0705F6F7A2C5AD85B01C4AD51AB6F0FD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:H."~).q~).q~).q._Eq\|).q.gAq\|).q._Gq\|).q._squ).qwQZq.).qe.Eq\|).qwQJqu).q~).q.).q._rqo).q._Bq.).q._Dq.).qRich~).q................PE..L...NO.X...........!................].............z.......................................@..........................2...C..$...........\...............................................................@............................................text............................... ..`.rdata..............................@..@.data...0............l..............@....rsrc...\...........................@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\tcl86t.dll

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1247232
Entropy (8bit):	6.7193396171923565
Encrypted:	false
SSDEEP:	24576:KF/Ldrs73MLcMj8uAViqlHMzSdMVFCBHQr0KixgwqmebyRWbdTi1JSFi:GpX4Sx+cZTi
MD5:	2738CB123399E87D08CEDF8AFAA11E1C
SHA1:	58FC1DD450A946109C9AFE43C1318574F9708750
SHA-256:	AA78997768D31687B809C950E7119A51B2513027871CDD61601BA63100FC0AE2
SHA-512:	8661EB91749BF67DE80475FF86D54692EBAFB0B129EDB417C7A44C2E01F9AE0AB9A62EADBCC9BB7491C9514710C0FB779FEB464E729EB764E2D7B276BB15BFC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..yq..y..y...y..y...y..y..6y..y..7y..y..y..y..y..y..y...y..2yL.y...y..y...y..y...y..yRich..y........PE..L....#.R...........!.........r...............................................P............@..............................^..............8...............................................................@...............x............................text.............................. ..`.rdata..............................@..@.data...A....p.......X..............@....rsrc...8............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\tcl\auto.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21317
Entropy (8bit):	4.727509354281714
Encrypted:	false
SSDEEP:	384:vyPcB5RJtA6zoISP9tYP9W5HU3mOuWzXBEWKYHEN+7yBtYSbI0QD+lM:AcB5RJtA67SPPYPT3mOuiVHEN+78YSby
MD5:	089C0FD2791281C125E5358F6E6A9ED2
SHA1:	87760E9173A441AD0C4B77CB9E64355B50F1AFCC
SHA-256:	4B69936A56E34C66D3C7FBE2F78D12AC4290E41E7FE8A50E9E481E05BA1F5A68
SHA-512:	A3663595710AB9818D3E6FC3EFD05B2A9C88B2DD10D91EFB5575B298C2F70272B8F5C2CC5BB97A1B9A39E399BA3AB01604A48526769C7E41F626C2E10D203E6A
Malicious:	false
Preview:	# auto.tcl --.#.# utility procs formerly in init.tcl dealing with auto execution of commands.# and can be auto loaded themselves..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# auto_reset --.#.# Destroy all cached information for auto-loading and auto-execution, so that.# the information gets recomputed the next time it's needed. Also delete any.# commands that are listed in the auto-load index..#.# Arguments:.# None...proc auto_reset {} {. global auto_execs auto_index auto_path. if {[array exists auto_index]} {..foreach cmdName [array names auto_index] {.. set fqcn [namespace which $cmdName].. if {$fqcn eq ""} {...continue.. }.. rename $fqcn {}..}. }. unset -nocomplain auto_execs auto_index ::tcl::auto_oldpath. if {[catch {llength $auto_path}]} {..

C:\ProgramData\assignee\tcl\clock.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	129701
Entropy (8bit):	5.000905376400773
Encrypted:	false
SSDEEP:	3072:WklVEuSDtejrmGtvaui+urVke5i1IsQ5g8tTImhr2PrzAvtt2eyw7uxH/SOyQass:2DtejrmEaui+urVke5i1R6g8tTImhrwU
MD5:	16BCE259DF356EEF41E258A9ACD1831E
SHA1:	62EF6FF4257BF4044EF84BDC4D2D186B76689E76
SHA-256:	180A969D7F5F7E695D9E65F1C52E932A1343C0437430DA28CF2C583C61B58386
SHA-512:	F8B42096A8393264884217AAA71C6D08519EB987BF2CB16D10D17E07B59DDEF51C6272EE85D8876DDA58702D5F03025776F2BB3295593325AA3D8CF05BBFE39F
Malicious:	false
Preview:	#----------------------------------------------------------------------.#.# clock.tcl --.#.#.This file implements the portions of the [clock] ensemble that are.#.coded in Tcl. Refer to the users' manual to see the description of.#.the [clock] command and its subcommands..#.#.#----------------------------------------------------------------------.#.# Copyright (c) 2004,2005,2006,2007 by Kevin B. Kenny.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.#----------------------------------------------------------------------..# We must have message catalogs that support the root locale, and we need.# access to the Registry on Windows systems...uplevel \#0 {. package require msgcat 1.4. if { $::tcl_platform(platform) eq {windows} } {..if { [catch { package require registry 1.1 }] } {.. namespace eval ::tcl::clock [list variable NoRegistry {}]..}. }.}..# Put the library directory into the namespace

C:\ProgramData\assignee\tcl\encoding\ascii.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	2.009389929214244
Encrypted:	false
SSDEEP:	12:5TUvEESVrVJ/eyN9j233V2NdWTeVCT0VbsV7EV7sYnVAMmVZyg851VqxsGkl/:5TUmJvRju3ShVbsZiAMiZyb7PF
MD5:	68D69C53B4A9F0AABD60646CA7E06DAE
SHA1:	DD83333DC1C838BEB9102F063971CCC20CC4FD80
SHA-256:	294C97175FD0894093B866E73548AE660AEED0C3CC1E73867EB66E52D34C0DD2
SHA-512:	48960E838D30401173EA0DF8597BB5D9BC3A09ED2CFFCB774BA50CB0B2ACCF47AAD3BA2782B3D4A92BEF572CBD98A3F4109FC4344DB82EB207BFDE4F61094D72
Malicious:	false
Preview:	# Encoding file: ascii, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\big5.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92873
Entropy (8bit):	3.255311357682213
Encrypted:	false
SSDEEP:	768:3kkmY4kD7HGJxYXIdjQWTGzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jj9:cGfKqIQCGzv8D7ksb2Ur79jj9
MD5:	9E67816F304FA1A8E20D2270B3A53364
SHA1:	9E35EBF3D5380E34B92FE2744124F9324B901DD3
SHA-256:	465AE2D4880B8006B1476CD60FACF676875438244C1D93A7DBE4CDE1035E745F
SHA-512:	EE529DA3511EB8D73465EB585561D54833C46B8C31062299B46F5B9EE7EB5BE473E630AA264F45B2806FC1B480C8ED39A173FF1756CB6401B363568E951F0637
Malicious:	false
Preview:	# Encoding file: big5, multi-byte.M.003F 0 89.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\cp1250.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.286986942547087
Encrypted:	false
SSDEEP:	24:CqTUmJvRju3ShVbsZiAMiZyb7Ptuja5z8twsDO4yT2H:JgmOEVIwAMiw/Ptuja5z8RDtyT2H
MD5:	79ACD9BD261A252D93C9D8DDC42B8DF6
SHA1:	FA2271030DB9005D71FAAD60B44767955D5432DD
SHA-256:	1B42DF7E7D6B0FEB17CB0BC8D97E6CE6899492306DD880C48A39D1A2F0279004
SHA-512:	607F21A84AE569B19DF42463A56712D232CA192E1827E53F3ACB46D373EF4165A38FFBF116E28D4EAAEF49B08F6162C7A1C517CCE2DFACA71DA07193FEFFFF06
Malicious:	false
Preview:	# Encoding file: cp1250, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E2026202020210088203001602039015A0164017D0179.009020182019201C201D202220132014009821220161203A015B0165017E017A.00A002C702D8014100A4010400A600A700A800A9015E00AB00AC00AD00AE017B.00B000B102DB014200B400B500B600B700B80105015F00BB013D02DD013E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D00E

C:\ProgramData\assignee\tcl\encoding\cp1251.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.288070862623515
Encrypted:	false
SSDEEP:	24:CTTUmJvRju3ShVbsZiAMiZyb7P4DRrwFsC/+H+SAJlM9aHe3cmx:wgmOEVIwAMiw/PStwFz/T5+smx
MD5:	55FB20FB09C610DB38C22CF8ADD4F7B8
SHA1:	604396D81FD2D90F5734FE6C3F283F8F19AABB64
SHA-256:	2D1BED2422E131A140087FAF1B12B8A46F7DE3B6413BAE8BC395C06F0D70B9B0
SHA-512:	07C6640BB40407C384BCF646CC436229AEC77C6398D57659B739DC4E180C81A1524F55A5A8F7B3F671A53320052AD888736383486CC01DFC317029079B17172E
Malicious:	false
Preview:	# Encoding file: cp1251, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.04020403201A0453201E20262020202120AC203004092039040A040C040B040F.045220182019201C201D202220132014009821220459203A045A045C045B045F.00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407.00B000B104060456049100B500B600B704512116045400BB0458040504550457.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.043004310432043304340435043604370438043

C:\ProgramData\assignee\tcl\encoding\cp1252.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2209074629945476
Encrypted:	false
SSDEEP:	24:C4TUmJvRju3ShVbsZiAMiZyb7PMmVurcNvPNNAkbnMH+tjg:rgmOEVIwAMiw/PMhrUok7zE
MD5:	5900F51FD8B5FF75E65594EB7DD50533
SHA1:	2E21300E0BC8A847D0423671B08D3C65761EE172
SHA-256:	14DF3AE30E81E7620BE6BBB7A9E42083AF1AE04D94CF1203565F8A3C0542ACE0
SHA-512:	EA0455FF4CD5C0D4AFB5E79B671565C2AEDE2857D534E1371F0C10C299C74CB4AD113D56025F58B8AE9E88E2862F0864A4836FED236F5730360B2223FDE479DC
Malicious:	false
Preview:	# Encoding file: cp1252, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D017D008F.009020182019201C201D20222013201402DC21220161203A0153009D017E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E800E

C:\ProgramData\assignee\tcl\encoding\cp1253.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.3530146237761445
Encrypted:	false
SSDEEP:	24:CRTUmJvRju3ShVbsZiAMiZyb7PMuW24OrKUQQSqJWeIDmq:CgmOEVIwAMiw/PMuW2nKJQSqJWeI1
MD5:	2E5F553D214B534EBA29A9FCEEC36F76
SHA1:	8FF9A526A545D293829A679A2ECDD33AA6F9A90E
SHA-256:	2174D94E1C1D5AD93717B9E8C20569ED95A8AF51B2D3AB2BCE99F1A887049C0E
SHA-512:	44AB13C0D322171D5EE62946086058CF54963F91EC3F899F3A10D051F9828AC66D7E9F8055026E938DDD1B97A30D5D450B89D72F9113DEE2DBBB62DDBBBE456C
Malicious:	false
Preview:	# Encoding file: cp1253, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F.009020182019201C201D20222013201400982122009A203A009C009D009E009F.00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015.00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B803B

C:\ProgramData\assignee\tcl\encoding\cp1254.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2357714075228494
Encrypted:	false
SSDEEP:	24:CWTUmJvRju3ShVbsZiAMiZyb7PMSrcmvPNNAkKMH+tZL/M:lgmOEVIwAMiw/PMSrrokKzR0
MD5:	35AD7A8FC0B80353D1C471F6792D3FD8
SHA1:	484705A69596C9D813EA361625C3A45C6BB31228
SHA-256:	BC4CBE4C99FD65ABEA45FBDAF28CC1D5C42119280125FBBD5C2C11892AE460B2
SHA-512:	CCA3C6A4B826E0D86AC10E45FFC6E5001942AA1CF45B9E0229D56E06F2600DDA0139764F1222C56CF7A9C14E6E6C387F9AB265CB9B936E803FECD8285871C70F
Malicious:	false
Preview:	# Encoding file: cp1254, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D008E008F.009020182019201C201D20222013201402DC21220161203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E800E

C:\ProgramData\assignee\tcl\encoding\cp1255.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.267336792625871
Encrypted:	false
SSDEEP:	24:CfTUmJvRju3ShVbsZiAMiZyb7PMI22iEePlNQhv6l50b:MgmOEVIwAMiw/PMI27EsQhvgg
MD5:	0419DBEE405723E7A128A009DA06460D
SHA1:	660DBE4583923CBDFFF6261B1FADF4349658579C
SHA-256:	F8BD79AE5A90E5390D77DC31CB3065B0F93CB8813C9E67ACCEC72E2DB2027A08
SHA-512:	FDD9F23A1B5ABBF973BEE28642A7F28F767557FE842AF0B30B1CF97CD258892F82E547392390A51900DC7FF5D56433549A5CB463779FC131E885B00568F86A32
Malicious:	false
Preview:	# Encoding file: cp1255, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F.009020182019201C201D20222013201402DC2122009A203A009C009D009E009F.00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF.05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF.05C005C105C205C305F005F105F205F305F40000000000000000000000000000.05D005D105D205D305D405D505D605D705D805D

C:\ProgramData\assignee\tcl\encoding\cp1256.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.3332869352420795
Encrypted:	false
SSDEEP:	24:C0TUmJvRju3ShVbsZiAMiZyb7Ps0pPESLym/cwPm+ZMZjyco/fQIG/h:XgmOEVIwAMiw/Ps0FPLym/AsBfg/h
MD5:	0FFA293AA50AD2795EAB7A063C4CCAE5
SHA1:	38FEE39F44E14C3A219978F8B6E4DA548152CFD6
SHA-256:	BBACEA81D4F7A3A7F3C036273A4534D31DBF8B6B5CCA2BCC4C00CB1593CF03D8
SHA-512:	AB4A6176C8C477463A6CABD603528CEB98EF4A7FB9AA6A8659E1AA6FE3F88529DB9635D41649FBAD779AEB4413F9D8581E6CA078393A3042B468E8CAE0FA0780
Malicious:	false
Preview:	# Encoding file: cp1256, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC067E201A0192201E20262020202102C62030067920390152068606980688.06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA.00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F.06C1062106220623062406250626062706280629062A062B062C062D062E062F.063006310632063306340635063600D7063706380639063A0640064106420643.00E0064400E2064506460647064800E700E800E

C:\ProgramData\assignee\tcl\encoding\cp1257.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2734430397929604
Encrypted:	false
SSDEEP:	24:CNTUmJvRju3ShVbsZiAMiZyb7PtuWTfN641PaxUVG4da:ugmOEVIwAMiw/PtuWkgVfa
MD5:	A1CCD70248FEA44C0EBB51FB71D45F92
SHA1:	CC103C53B3BA1764714587EAEBD92CD1BC75194D
SHA-256:	4151434A714FC82228677C39B07908C4E19952FC058E26E7C3EBAB7724CE0C77
SHA-512:	74E4A13D65FAB11F205DB1E6D826B06DE421282F7461B273196FD7EECEE123EA0BD32711640B15B482C728966CC0C70FFC67AEDAD91566CA87CD623738E34726
Malicious:	false
Preview:	# Encoding file: cp1257, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8.009020182019201C201D20222013201400982122009A203A009C00AF02DB009F.00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010D00E

C:\ProgramData\assignee\tcl\encoding\cp1258.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.226508038800896
Encrypted:	false
SSDEEP:	24:CKlTUmJvRju3ShVbsZiAMiZyb7PMIX2jmvPNNXkohWiZo//:xgmOEVIwAMiw/PMIXXfkohnun
MD5:	BB010BFF4DD16B05EEB6E33E5624767A
SHA1:	6294E42ED22D75679FF1464FF41D43DB3B1824C2
SHA-256:	0CDB59E255CCD7DCF4AF847C9B020AEAEE78CE7FCF5F214EBCF123328ACF9F24
SHA-512:	2CD34F75DC61DC1495B0419059783A5579932F43DB9B125CADCB3838A142E0C1CD7B42DB71EF103E268206E31099D6BB0670E84D5658C0E18D0905057FF87182
Malicious:	false
Preview:	# Encoding file: cp1258, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F.009020182019201C201D20222013201402DC2122009A203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF.011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF.00E000E100E2010300E400E500E600E700E800E

C:\ProgramData\assignee\tcl\encoding\cp437.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.447501009231115
Encrypted:	false
SSDEEP:	24:CFyTUmJvRju3ShVbsZiAMiZyb7P4jpuKBIrRjK8DvmH:wygmOEVIwAMiw/PYwjKgmH
MD5:	8645C2DFCC4D5DAD2BCD53A180D83A2F
SHA1:	3F725245C66050D39D9234BAACE9D047A3842944
SHA-256:	D707A1F03514806E714F01CBFCB7C9F9973ACDC80C2D67BBD4E6F85223A50952
SHA-512:	208717D7B1CBDD8A0B8B3BE1B6F85353B5A094BDC370E6B8396158453DD7DC400EE6C4D60490AD1A1F4C943E733298FC971AE30606D6BAB14FB1290B886C76D0
Malicious:	false
Preview:	# Encoding file: cp437, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\ProgramData\assignee\tcl\encoding\cp737.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.551534707521956
Encrypted:	false
SSDEEP:	24:CjTUmJvRju3ShVbsZiAMiZyb7P48KhQFhWeYDr1K8DZckbiY:WgmOEVIwAMiw/P9KhQFhWeY31Kk2Y
MD5:	C68ADEFE02B77F6E6B5217CD83D46406
SHA1:	C95EA4ED3FBEF013D810C0BFB193B15FA8ADE7B8
SHA-256:	8BFCA34869B3F9A3B2FC71B02CBAC41512AF6D1F8AB17D2564E65320F88EDE10
SHA-512:	5CCAACD8A9795D4FE0FD2AC6D3E33C10B0BCC43B29B45DFBA66FBD180163251890BB67B8185D806E4341EB01CB1CED6EA682077577CC9ED948FC094B099A662A
Malicious:	false
Preview:	# Encoding file: cp737, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.039103920393039403950396039703980399039A039B039C039D039E039F03A0.03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8.03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03C903AC03AD03AE03CA03AF03CC03CD03CB03CE

C:\ProgramData\assignee\tcl\encoding\cp775.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3818286672990854
Encrypted:	false
SSDEEP:	24:CsOTUmJvRju3ShVbsZiAMiZyb7P4DBcqb67JnsUgqIPfJ:AgmOEVIwAMiw/PSzb67NsrLPR
MD5:	DE1282E2925870A277AF9DE4C52FA457
SHA1:	F4301A1340A160E1F282B5F98BF9FACBFA93B119
SHA-256:	44FB04B5C72B584B6283A99B34789690C627B5083C5DF6E8B5B7AB2C68903C06
SHA-512:	08173FC4E5FC9AA9BD1E296F299036E49C0333A876EA0BDF40BEC9F46120329A530B6AA57B32BC83C7AA5E6BD20DE9F616F4B17532EE54634B6799C31D8F668F
Malicious:	false
Preview:	# Encoding file: cp775, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.010600FC00E9010100E4012300E501070142011301560157012B017900C400C5.00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4.0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB.259125922593250225240104010C01180116256325512557255D012E01602510.25142534252C251C2500253C0172016A255A25542569256625602550256C017D.0105010D01190117012F01610173016B017E2518250C25882584258C25902580.00D300DF014C014300F500D500B5014401360137

C:\ProgramData\assignee\tcl\encoding\cp850.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.301196372002172
Encrypted:	false
SSDEEP:	24:C9TUmJvRju3ShVbsZiAMiZyb7P4jpuKBc+mTRF5aefDT4HJ:EgmOEVIwAMiw/PYelF5xfn4p
MD5:	FF3D96C0954843C7A78299FED6986D9E
SHA1:	5EAD37788D124D4EE49EC4B8AA1CF6AAA9C2849C
SHA-256:	55AA2D13B789B3125F5C9D0DC5B6E3A90D79426D3B7825DCD604F56D4C6E36A2
SHA-512:	B76CD82F3204E17D54FB679615120564C53BBE27CC474101EE073EFA6572B50DB2E9C258B09C0F7EAE8AC445D469461364C81838C07D41B43E353107C06C247E
Malicious:	false
Preview:	# Encoding file: cp850, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192.00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B500FE00DE00DA

C:\ProgramData\assignee\tcl\encoding\cp852.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3816687566591797
Encrypted:	false
SSDEEP:	24:CPTUmJvRju3ShVbsZiAMiZyb7P4OvEUs5ycHQjc59X/C:mgmOEVIwAMiw/Pkv5ycHQjc59Xa
MD5:	25A59EA83B8E9F3322A54B138861E274
SHA1:	904B357C30603DFBCF8A10A054D9399608B131DF
SHA-256:	5266B6F18C3144CFADBCB7B1D27F0A7EAA1C641FD3B33905E42E4549FD373770
SHA-512:	F7E41357849599E7BA1D47B9B2E615C3C2EF4D432978251418EBF9314AAEB0E1B0A56ED14ED9BA3BE46D3DABE5DD80E0CA6592AE88FB1923E7C3D90D7F846709
Malicious:	false
Preview:	# Encoding file: cp852, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106.00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D.00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB.2591259225932502252400C100C2011A015E256325512557255D017B017C2510.25142534252C251C2500253C01020103255A25542569256625602550256C00A4.01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580.00D300DF00D401430144014801600161015400DA

C:\ProgramData\assignee\tcl\encoding\cp855.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3580450853378596
Encrypted:	false
SSDEEP:	24:CoTUmJvRju3ShVbsZiAMiZyb7P4hHVLjwk6rMZCb32SLauDbr:hgmOEVIwAMiw/PM/wcMb3VuuT
MD5:	0220F1955F01B676D2595C30DEFB6064
SHA1:	F8BD4BF6D95F672CB61B8ECAB580A765BEBDAEA5
SHA-256:	E3F071C63AC43AF66061506EF2C574C35F7BF48553FB5158AE41D9230C1A10DF
SHA-512:	F7BFF7D6534C9BFDBF0FB0147E31E948F60E933E6DA6A39E8DC62CC55FEBDD6901240460D7B3C0991844CDEE7EB8ED26E5FDBBC12BDC9B8173884D8FCA123B69
Malicious:	false
Preview:	# Encoding file: cp855, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0452040204530403045104010454040404550405045604060457040704580408.04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A.0430041004310411044604260434041404350415044404240433041300AB00BB.259125922593250225240445042504380418256325512557255D043904192510.25142534252C251C2500253C043A041A255A25542569256625602550256C00A4.043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580.042F044004200441042104420422044304230436

C:\ProgramData\assignee\tcl\encoding\cp857.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.2936796452153128
Encrypted:	false
SSDEEP:	24:CaTUmJvRju3ShVbsZiAMiZyb7P4jpu6u/5WH5aeoC4ljIJ:jgmOEVIwAMiw/Pr/UH5xp4l6
MD5:	58C52199269A3BB52C3E4C20B5CE6093
SHA1:	888499D9DFDF75C60C2770386A4500F35753CE70
SHA-256:	E39985C6A238086B54427475519C9E0285750707DB521D1820E639723C01C36F
SHA-512:	754667464C4675E8C8F2F88A9211411B3648068085A898D693B33BF3E1FAECC9676805FD2D1A4B19FAAB30E286236DCFB2FC0D498BF9ABD9A5E772B340CEE768
Malicious:	false
Preview:	# Encoding file: cp857, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5.00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F.00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B5000000D700DA

C:\ProgramData\assignee\tcl\encoding\cp860.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.438607583601603
Encrypted:	false
SSDEEP:	24:CMTUmJvRju3ShVbsZiAMiZyb7P4Aj4AxOt49+nK8DvmH:VgmOEVIwAMiw/PeR+snKgmH
MD5:	8CA7C4737A18D5326E9A437D5ADC4A1A
SHA1:	C6B1E9320EEF46FC9A23437C255E4085EA2980DB
SHA-256:	6DB59139627D29ABD36F38ED2E0DE2A6B234A7D7E681C7DBAF8B888F1CAC49A5
SHA-512:	2D2427E7A3FF18445321263A42C6DA560E0250691ACBE5113BDE363B36B5E9929003F3C91769A02FF720AB8261429CBFA9D9580C1065FFE77400327B1A5539A6
Malicious:	false
Preview:	# Encoding file: cp860, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2.00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3.00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\ProgramData\assignee\tcl\encoding\cp861.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.4494568686644276
Encrypted:	false
SSDEEP:	24:ClTUmJvRju3ShVbsZiAMiZyb7P4jpOkPn9R2GRK8DvmH:8gmOEVIwAMiw/PAPXvKgmH
MD5:	45F0D888DBCB56703E8951C06CFAED51
SHA1:	53529772EA6322B7949DB73EEBAED91E5A5BA3DA
SHA-256:	A43A5B58BFC57BD723B12BBDEA9F6E1A921360B36D2D52C420F37299788442D3
SHA-512:	61D0C361E1C7D67193409EC327568867D1FD0FE448D11F16A08638D3EE31BE95AD37B8A2E67B8FB448D09489AA3F5D65AD9AC18E9BDC690A049F0C015BA806F1
Malicious:	false
Preview:	# Encoding file: cp861, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5.00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192.00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\ProgramData\assignee\tcl\encoding\cp862.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.4900477558394694
Encrypted:	false
SSDEEP:	24:CdMTUmJvRju3ShVbsZiAMiZyb7P4N6rRjK8DvmH:iMgmOEVIwAMiw/PljKgmH
MD5:	E417DCE52E8438BBE9AF8AD51A09F9E3
SHA1:	EF273671D46815F22996EA632D22CC27EB8CA44B
SHA-256:	AEA716D490C35439621A8F00CA7E4397EF1C70428E206C5036B7AF25F1C3D82F
SHA-512:	97D65E05008D75BC56E162D51AB76888E1FA0591D9642D7C0D09A5CE823904B5D6C14214828577940EDBE7F0265ABACDD67E4E12FACFDF5C7CD35FA80B90EC02
Malicious:	false
Preview:	# Encoding file: cp862, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF.05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\ProgramData\assignee\tcl\encoding\cp863.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.450081751310228
Encrypted:	false
SSDEEP:	24:CXTUmJvRju3ShVbsZiAMiZyb7P4aGuXVsq5RNK8DvmH:egmOEVIwAMiw/PT3VswKgmH
MD5:	A2C4062EB4F37C02A45B13BD08EC1120
SHA1:	7F6ED89BD0D415C64D0B8A037F08A47FEADD14C4
SHA-256:	13B5CB481E0216A8FC28BFA9D0F6B060CDF5C457B3E12435CA826EB2EF52B068
SHA-512:	95EFDA8CBC5D52E178640A145859E95A780A8A25D2AF88F98E8FFFA035016CABAE2259D22B3D6A95316F64138B578934FAF4C3403E35C4B7D42E0369B5D88C9B
Malicious:	false
Preview:	# Encoding file: cp863, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7.00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192.00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\ProgramData\assignee\tcl\encoding\cp864.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.6558830653506647
Encrypted:	false
SSDEEP:	24:CwTUmJvRju3YhVbsZiAMiZyb7P46SY927iqtcYQjDUjSD:5gmOqVIwAMiw/PCXjcYQfcSD
MD5:	3C88BF83DBA99F7B682120FBEEC57336
SHA1:	E0CA400BAE0F66EEBE4DFE147C5A18DD3B00B78C
SHA-256:	E87EC076F950FCD58189E362E1505DD55B0C8F4FA7DD1A9331C5C111D2CE569F
SHA-512:	6BD65D0A05F57333DA0078759DB2FC629B56C47DAB24E231DE41AD0DF3D07BF7A2A55D1946A7BA38BE228D415FB2BDB606BF1EF243974ED7DFD204548B2A43BA
Malicious:	false
Preview:	# Encoding file: cp864, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00200021002200230024066A0026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00B000B72219221A259225002502253C2524252C251C25342510250C25142518.03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F.00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5.0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F.00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9.FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9.0640FED3FED7FEDBFEDFFEE3FEE7FEEBFEEDFEEF

C:\ProgramData\assignee\tcl\encoding\cp865.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.451408971174579
Encrypted:	false
SSDEEP:	24:CsKTUmJvRju3ShVbsZiAMiZyb7P4jpuKBn9RUK8DvmH:ggmOEVIwAMiw/PYRXUKgmH
MD5:	6F290E2C3B8A8EE38642C23674B18C71
SHA1:	0EB40FEEB8A382530B69748E08BF513124232403
SHA-256:	407FC0FE06D2A057E9BA0109EA9356CAB38F27756D135EF3B06A85705B616F50
SHA-512:	A975F69360A28484A8A3B4C93590606B8F372A27EC612ECC2355C9B48E042DCE132E64411CF0B107AA5566CAF6954F6937BEBFE17A2AE79EFF25B67FA0F88B7D
Malicious:	false
Preview:	# Encoding file: cp865, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\ProgramData\assignee\tcl\encoding\cp866.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.435639928335435
Encrypted:	false
SSDEEP:	24:CCTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aHe3cIK8D/eke:bgmOEVIwAMiw/Pr5+sIK8ev
MD5:	C612610A7B63519BB7FEFEE26904DBB5
SHA1:	431270939D3E479BF9B9A663D9E67FCEBA79416F
SHA-256:	82633643CD326543915ACC5D28A634B5795274CD39974D3955E51D7330BA9338
SHA-512:	A3B84402AB66B1332C150E9B931E75B401378DDB4378D993DD460C81909DB72F2D136F0BE7B014F0A907D9EF9BE541C8E0B42CAB01667C6EF17E1DE1E0A3D0AE
Malicious:	false
Preview:	# Encoding file: cp866, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.0440044104420443044404450446044704480449

C:\ProgramData\assignee\tcl\encoding\cp869.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.458262128093304
Encrypted:	false
SSDEEP:	24:CtTUmJvRju3ShVbsZiAMiZyb7P4UN+lhNo5+8dKfQFhWGDrjz9:EgmOEVIwAMiw/PxYNo5+8dKfQFhWG3jZ
MD5:	51B18570775BCA6465BD338012C9099C
SHA1:	E8149F333B1809DCCDE51CF8B6332103DDE7FC30
SHA-256:	27F16E3DD02B2212C4980EA09BDC068CF01584A1B8BB91456C03FCABABE0931E
SHA-512:	EB285F0E5A9333FFF0E3A6E9C7CAC9D44956EDF180A46D623989A93683BC70EE362256B58EB9AED3BFC6B5C8F5DB4E42540DFC681D51D22A97398CD18F76A1E1
Malicious:	false
Preview:	# Encoding file: cp869, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850386008700B700AC00A620182019038820150389.038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF.03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB.25912592259325022524039A039B039C039D256325512557255D039E039F2510.25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3.03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580.03B603B703B803B903BA03BB03BC03BD03BE03BF

C:\ProgramData\assignee\tcl\encoding\cp874.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.2660589395582478
Encrypted:	false
SSDEEP:	24:CSyTUmJvRju3ShVbsZiAMiZyb7PQXzHmED43U/TW5dV:CgmOEVIwAMiw/PIr43UKV
MD5:	7884C95618EF4E9BAA1DED2707F48467
SHA1:	DA057E1F93F75521A51CC725D47130F41E509E70
SHA-256:	3E067363FC07662EBE52BA617C2AAD364920F2AF395B3416297400859ACD78BB
SHA-512:	374AA659A8DB86C023187D02BD7993516CE0EC5B4C6743AD4956AA2DDB86D2B4A57B797253913E08E40485BF3263FBD1C74DDE2C00E6F228201811ED89A6DFF0
Malicious:	false
Preview:	# Encoding file: cp874, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC008100820083008420260086008700880089008A008B008C008D008E008F.009020182019201C201D20222013201400980099009A009B009C009D009E009F.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E49

C:\ProgramData\assignee\tcl\encoding\cp932.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48207
Entropy (8bit):	3.450462303370557
Encrypted:	false
SSDEEP:	768:LhuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtZ7RkEw:LZPV9KuqTxFGXZlQ
MD5:	AA4398630883066C127AA902832C82E4
SHA1:	D0B3DEB0EE6539CE5F28A51464BFBB3AA03F28E5
SHA-256:	9D33DF6E1CFDD2CF2553F5E2758F457D710CAFF5F8C69968F2665ACCD6E9A6FD
SHA-512:	77794E74B0E6B5855773EE9E1F3B1DA9DB7661D66485DAE6F61CA69F6DA9FD308A55B3A76C9B887135949C60FC3888E6F9A45C6BC481418737AA452A0D9CAE64
Malicious:	false
Preview:	# Encoding file: cp932, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\cp936.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	132509
Entropy (8bit):	3.458586416034501
Encrypted:	false
SSDEEP:	1536:JUbXcUPivzybu9VBPbUQMp8nDr+VFQQHkrUkAEAd4WD7tH8dd1+a:muVDQEr2dhDBH8d3+a
MD5:	27280A39A06496DE6035203A6DAE5365
SHA1:	3B1D07B02AE7E3B40784871E17F36332834268E6
SHA-256:	619330192984A80F93AC6F2E4E5EAA463FD3DDDC75C1F65F3975F33E0DD7A0BB
SHA-512:	EA05CC8F9D6908EE2241E2A72374DAAD55797B5A487394B4C2384847C808AF091F980951941003039745372022DE88807F93EEF6CDB3898FBB300A48A09B66E8
Malicious:	false
Preview:	# Encoding file: cp936, multi-byte.M.003F 0 127.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\cp949.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	130423
Entropy (8bit):	3.0309641114333425
Encrypted:	false
SSDEEP:	1536:fimT/rTarSdgL6MVTCwCWUw62Ljv10xb+KYTuHEh:ftT/IQYLzGxSdCy
MD5:	6788B104D2297CBD8D010E2776AF6EBA
SHA1:	904A8B7846D34521634C8C09013DBB1D31AF47CA
SHA-256:	26BCB620472433962717712D04597A63264C8E444459432565C4C113DE0A240B
SHA-512:	0DF73561B76159D0A94D16A2DAB22F2B3D88C67146A840CB74D19E70D50A4C7E4DDF1952B5B805471985A896CA9F1B69C3FC4E6D8D17454566D7D39377BA1394
Malicious:	false
Preview:	# Encoding file: cp949, multi-byte.M.003F 0 125.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\cp950.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91831
Entropy (8bit):	3.253346615914323
Encrypted:	false
SSDEEP:	768:VkkmY4kD7HGJxYXIdjQW7GzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jjA:mGfKqIQwGzv8D7ksb2Ur79jjA
MD5:	A0F8C115D46D02A5CE2B8C56AFF53235
SHA1:	6605FCCB235A08F9032BB45231B1A6331764664B
SHA-256:	1FB9A3D52D432EA2D6CD43927CEBF9F58F309A236E1B11D20FE8D5A5FB944E6E
SHA-512:	124EA2134CF59585DB2C399B13DE67089A6BB5412D2B210DF484FA38B77555AAF0605D04F441BDC2B0BE0F180FA17C145731D7826DA7556A573D357CC00A968F
Malicious:	false
Preview:	# Encoding file: cp950, multi-byte.M.003F 0 88.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\dingbats.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.7149721845090347
Encrypted:	false
SSDEEP:	24:vJM0UmJvRjuyfqYCsUBOdXBCbtwHviANskfUPiXFtoE4OSFgHrBPkq:vKfmOEqYCs6CXRPiANIiXFt9XSMdPH
MD5:	7715CC78774FEA9EB588397D8221FA5B
SHA1:	6A21D57B44A0856ABCDE61B1C16CB93F4E4C3D74
SHA-256:	3BDE9AE7EAF9BE799C84B2AA4E80D78BE8ACBACA1E486F10B9BDD42E3AEDDCB2
SHA-512:	C7500B9DD36F7C92C1A92B8F7BC507F6215B12C26C8CB4564A8A87299859C29C05DEFD3212DE8F2DB76B7DFAB527D6C7B10D1E9A9F6B682F1B5BC4911CFAD26C
Malicious:	false
Preview:	# Encoding file: dingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727A82

C:\ProgramData\assignee\tcl\encoding\ebcdic.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	2.92745681322567
Encrypted:	false
SSDEEP:	24:scICJZoBqoQzRKCGW5JyY9yZk3Vvd2p4Z4XgiAmV3q:JmqrRKCtEYYZk3V4WSwitV6
MD5:	67212AAC036FE54C8D4CDCB2D03467A6
SHA1:	465509C726C49680B02372501AF7A52F09AB7D55
SHA-256:	17A7D45F3B82F2A42E1D36B13DB5CED077945A3E82700947CD1F803DD2A60DBF
SHA-512:	9500685760800F5A31A755D582FCEDD8BB5692C27FEEEC2709D982C0B8FCB5238AFB310DCB817F9FE140086A8889B7C60D5D1017764CEB03CB388DD22C8E0B3E
Malicious:	false
Preview:	S.006F 0 1.00.0000000100020003008500090086007F0087008D008E000B000C000D000E000F.0010001100120013008F000A0008009700180019009C009D001C001D001E001F.0080008100820083008400920017001B00880089008A008B008C000500060007.0090009100160093009400950096000400980099009A009B00140015009E001A.002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C.002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F.002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F.00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022.00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1.00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4.00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE.00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7.00F900410042004300440045004600470048004900AD00F400F600F200F300F5.00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF.00D900F70053005400550056005700580059005A00B200D400D600D200D300D5.00300031003

C:\ProgramData\assignee\tcl\encoding\euc-cn.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85574
Entropy (8bit):	2.3109636068522357
Encrypted:	false
SSDEEP:	384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
MD5:	9A60E5D1AB841DB3324D584F1B84F619
SHA1:	BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
SHA-256:	546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
SHA-512:	E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\euc-jp.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	82537
Entropy (8bit):	2.267779266005065
Encrypted:	false
SSDEEP:	384:c7C2o8+/s5VHxANqsFvGFkMpUEg4MWv947ebZ745zIPcvZ3p6JhE1mrUH2xUoSuL:U+UTHxAlFxkUeGcOmaj6JhEMrUwLf3d1
MD5:	453626980EB36062E32D98ACECCCBD6E
SHA1:	F8FCA3985009A2CDD397CB3BAE308AF05B0D7CAC
SHA-256:	3BFB42C4D36D1763693AEFCE87F6277A11AD5A756D691DEDA804D9D0EDCB3093
SHA-512:	0F026E1EF3AE1B08BBC7050DB0B181B349511F2A526D2121A6100C426674C0FB1AD6904A5CC11AA924B7F03E33F6971599BAF85C94528428F2E22DCB7D6FE443
Malicious:	false
Preview:	# Encoding file: euc-jp, multi-byte.M.003F 0 79.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D0000008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\euc-kr.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93918
Entropy (8bit):	2.3267174168729032
Encrypted:	false
SSDEEP:	768:1/W3oNwgt2qyVY1OVxk6ZN4KYDN1uq44hohExh:1/W3pqv10xb+KYTuHEh
MD5:	93FEADA4D8A974E90E77F6EB8A9F24AB
SHA1:	89CDA4FE6515C9C03551E4E1972FD478AF3A419C
SHA-256:	1F1AD4C4079B33B706E948A735A8C3042F40CC68065C48C220D0F56FD048C33B
SHA-512:	7FC43C273F8C2A34E7AD29375A36B6CAC539AC4C1CDCECFAF0B366DCFE605B5D924D09DAD23B2EE589B1A8A63EE0F7A0CE32CE74AC873369DE8555C9E27A5EDF
Malicious:	false
Preview:	# Encoding file: euc-kr, multi-byte.M.003F 0 90.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\gb12345.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	86619
Entropy (8bit):	2.2972446758995697
Encrypted:	false
SSDEEP:	384:XSeUMIZQkyMiS4Y3fPOYo55XVi684z6WwQrrNoTRoyzDciB126afGG9whRJGAy/I:XhcQjSr3XeXVbmWdWd/zl5auG2hU/I
MD5:	12DBEEF45546A01E041332427FEC7A51
SHA1:	5C8E691AE3C13308820F4CF69206D765CFD5094B
SHA-256:	0C0DF17BFECE897A1DA7765C822453B09866573028CECCED13E2EFEE02BCCCC4
SHA-512:	FC8A250EE17D5E94A765AFCD9464ECAE74A4E2FF594A8632CEAEC5C84A3C4D26599642DA42E507B7873C37849D3E784CFB0792DE5B4B4262428619D7473FF611
Malicious:	false
Preview:	# Encoding file: gb12345, double-byte.D.233F 0 83.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\gb1988.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.1978221748141253
Encrypted:	false
SSDEEP:	24:qrmTUmJvRju36hVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:qSgmO8VIwAMiw/PNPQPFj
MD5:	06645FE6C135D2EDE313629D24782F98
SHA1:	49C663AC26C1FE4F0FD1428C9EF27058AEE6CA95
SHA-256:	A2717AE09E0CF2D566C245DC5C5889D326661B40DB0D5D9A6D95B8E6B0F0E753
SHA-512:	DB544CFE58753B2CF8A5D65321A2B41155FE2430DB6783DD2F20E1244657482072633D16C8AC99765C113B60E99C8718263C483763A34C5E4BB04B4FFBA41976
Malicious:	false
Preview:	# Encoding file: gb1988, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.002000210022002300A500250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\gb2312-raw.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84532
Entropy (8bit):	2.3130049332819502
Encrypted:	false
SSDEEP:	384:KSevutIzbwixZ1J9vS+MReR8cMvwKVDAcmaj8HEtG0waFtFsKQ2RzIjTfYahm6n3:Kat+wmTJYReltKVMeYkXOjYo5tG3VN+
MD5:	BF74C90D28E52DD99A01377A96F462E3
SHA1:	DBA09C670F24D47B95D12D4BB9704391B81DDA9A
SHA-256:	EC11BFD49C715CD89FB9D387A07CF54261E0F4A1CCEC1A810E02C7B38AD2F285
SHA-512:	8F5A86BB57256ED2412F6454AF06C52FB44C83EB7B820C642CA9216E9DB31D6EC22965BF5CB9E8AE4492C77C1F48EB2387B1CBDC80F6CDA33FA57C57EC9FF9CD
Malicious:	false
Preview:	# Encoding file: gb2312, double-byte.D.233F 0 81.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\gb2312.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85574
Entropy (8bit):	2.3109636068522357
Encrypted:	false
SSDEEP:	384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
MD5:	9A60E5D1AB841DB3324D584F1B84F619
SHA1:	BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
SHA-256:	546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
SHA-512:	E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\iso2022-jp.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.915818681498601
Encrypted:	false
SSDEEP:	3:SOd5MNXVSVLqRIBXSl1AEXMV/RRDfANDemSjs5dqcRcRZMvs5BCUNZ:SVNFS01K+MtkvSjwqd9NZ
MD5:	224219C864280FA5FB313ADBC654E37D
SHA1:	39E20B41CFA8B269377AFA06F9C4D66EDD946ACB
SHA-256:	E12928E8B5754D49D0D3E799135DE2B480BA84B5DBAA0E350D9846FA67F943EC
SHA-512:	6E390D83B67E2FD5BCAC1BA603A9C6F8BE071FA64021612CE5F8EE33FD8E3840A8C31A7B00134A0039E46BDC66BEF7EB6EA1F8663BA72816B86AF792EF7BDC56
Malicious:	false
Preview:	# Encoding file: iso2022-jp, escape-driven.E.name..iso2022-jp.init..{}.final..{}.ascii..\x1b(B.jis0201..\x1b(J.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.

C:\ProgramData\assignee\tcl\encoding\iso2022-kr.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.945508829557185
Encrypted:	false
SSDEEP:	3:SOd5MNXVTEXIBXSl1AEXNELmUHhqQc6XfUNOvn:SVNFS1K+9Qc6sNA
MD5:	F6464F7C5E3F642BC3564D59B888C986
SHA1:	94C5F39256366ABB68CD67E3025F177F54ECD39D
SHA-256:	6AC0F1845A56A1A537B9A6D9BCB724DDDF3D3A5E61879AE925931B1C0534FBB7
SHA-512:	B9A7E0A9344D8E883D44D1A975A7C3B966499D34BA6206B15C90250F88A8FA422029CEF190023C4E4BE806791AC3BEA87FD8872B47185B0CE0F9ED9C38C41A84
Malicious:	false
Preview:	# Encoding file: iso2022-kr, escape-driven.E.name..iso2022-kr.init..\x1b$)C.final..{}.iso8859-1.\x0f.ksc5601..\x0e.

C:\ProgramData\assignee\tcl\encoding\iso2022.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.925633473589168
Encrypted:	false
SSDEEP:	3:SOd5MNXVUW+IBXSl1AEXM56DfqQc6WHmSjs5dReQSXcRcRZMvs5BCUNxXeR5IHRv:SVNFUX1K+M55Qc6WGSjwRDSXd9NGIHRv
MD5:	745464FF8692E3C3D8EBBA38D23538C8
SHA1:	9D6F077598A5A86E6EB6A4EEC14810BF525FBD89
SHA-256:	753DDA518A7E9F6DC0309721B1FAAE58C9661F545801DA9F04728391F70BE2D0
SHA-512:	E919677CC96DEF4C75126A173AF6C229428731AB091CDDBB2A6CE4EB82BCD8191CE64A33B418057A15E094A48E846BEE7820619E414E7D90EDA6E2B66923DDA5
Malicious:	false
Preview:	# Encoding file: iso2022, escape-driven.E.name..iso2022.init..{}.final..{}.iso8859-1.\x1b(B.jis0201..\x1b(J.gb1988..\x1b(T.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.jis0208..\x1b&@\x1b$B.

C:\ProgramData\assignee\tcl\encoding\iso8859-1.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.163043970763833
Encrypted:	false
SSDEEP:	24:iyTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkbnMH+tjg:iygmOEVIwAMiw/PTvok7zE
MD5:	E3BAE26F5D3D9A4ADCF5AE7D30F4EC38
SHA1:	A71B6380EA3D23DC0DE11D3B8CEA86A4C8063D47
SHA-256:	754EF6BF3A564228AB0B56DDE391521DCC1A6C83CFB95D4B761141E71D2E8E87
SHA-512:	AFED8F5FE02A9A30987736F08B47F1C19339B5410D6020CC7EA37EA0D717A70AF6CDDC775F53CE261FCF215B579206E56458D61AB4CEB44E060BD6B3AC2F4C41
Malicious:	false
Preview:	# Encoding file: iso8859-1, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E8

C:\ProgramData\assignee\tcl\encoding\iso8859-10.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.2483197762497458
Encrypted:	false
SSDEEP:	24:jTUmJvRju3ShVbsZiAMiZyb7P4UP6L2yhBKyta:jgmOEVIwAMiw/PT6L2Ryta
MD5:	162E76BD187CB54A5C9F0B72A082C668
SHA1:	CEC787C4DE78F9DBB97B9C44070CF2C12A2468F7
SHA-256:	79F6470D9BEBD30832B3A9CA59CD1FDCA28C5BE6373BD01D949EEE1BA51AA7A8
SHA-512:	ADDBCA6E296286220FFF449D3E34E5267528627AFFF1FCBD2B9AC050A068D116452D70308049D88208FB7CB2C2F7582FCF1703CF22CFC125F2E6FA89B8A653FE
Malicious:	false
Preview:	# Encoding file: iso8859-10, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A.00B0010501130123012B0129013700B7013C011101610167017E2015016B014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF.00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF.010100E100E200E300E400E500E6012F010

C:\ProgramData\assignee\tcl\encoding\iso8859-13.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.267798724121087
Encrypted:	false
SSDEEP:	24:olTUmJvRju3ShVbsZiAMiZyb7P4UP1w4LaxUVG4dT:olgmOEVIwAMiw/PT+4VfT
MD5:	BF3993877A45AC7091CFC81CFD4A4D43
SHA1:	D462934A074EE13F2C810463FD061084953F77BC
SHA-256:	33C6072A006BA4E9513D7B7FD3D08B1C745CA1079B6D796C36B2A5AE8E4AE02B
SHA-512:	17489E6AD6A898628239EA1B43B4BE81ECC33608F0FD3F7F0E19CF74F7FC4752813C3C21F1DC73E9CC8765E23C63ED932799905381431DAF4E10A88EC29EBF6E
Malicious:	false
Preview:	# Encoding file: iso8859-13, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010

C:\ProgramData\assignee\tcl\encoding\iso8859-14.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.296489289648924
Encrypted:	false
SSDEEP:	24:vTUmJvRju3ShVbsZiAMiZyb7P4UPt6C5AkE7MH+tZS4Y:vgmOEVIwAMiw/PTAQAkCzsP
MD5:	3BE4986264587BEC738CC46EBB43D698
SHA1:	62C253AA7A868CE32589868FAB37336542457A96
SHA-256:	8D737283289BAF8C08EF1DD7E47A6C775DACE480419C5E2A92D6C0E85BB5B381
SHA-512:	CB9079265E47EF9672EAACFCE474E4D6771C6F61394F29CC59C9BBE7C99AE89A0EACD73F2BCDD8374C4E03BE9B1685F463F029E35C4070DF9D1B143B02CAD573
Malicious:	false
Preview:	# Encoding file: iso8859-14, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178.1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF.00E000E100E200E300E400E500E600E700E

C:\ProgramData\assignee\tcl\encoding\iso8859-15.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.1878838020538374
Encrypted:	false
SSDEEP:	24:mTUmJvRju3ShVbsZiAMiZyb7P4UPvRarkbnMH+tjg:mgmOEVIwAMiw/PTvqk7zE
MD5:	6AE49F4E916B02EB7EDB160F88B5A27F
SHA1:	49F7A42889FB8A0D78C80067BDE18094DBE956EE
SHA-256:	C7B0377F30E42048492E4710FE5A0A54FA9865395B8A6748F7DAC53B901284F9
SHA-512:	397E636F4B95522FD3909B4546A1B7E31E92388DAE4F9F6B638875449E3498B49320F4C4A47168C7ADD43C78EF5680CAAEE40661DDC8205687532D994133EA3B
Malicious:	false
Preview:	# Encoding file: iso8859-15, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF.00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E

C:\ProgramData\assignee\tcl\encoding\iso8859-16.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.2349228762697972
Encrypted:	false
SSDEEP:	24:dTUmJvRju3ShVbsZiAMiZyb7P4UP/SlTPkyTtZVc:dgmOEVIwAMiw/PTqFPkypXc
MD5:	D30094CAEFA5C4A332159829C6CB7FEC
SHA1:	50FDA6C70A133CB64CF38AA4B2F313B54D2FD955
SHA-256:	C40CA014B88F97AE62AE1A816C5963B1ED432A77D84D89C3A764BA15C8A23708
SHA-512:	6EDD6912053D810D1E2B0698494D26E119EF1BF3FABC2FBFBA44551792800FA0CF163773E4F37F908C2DE41F05D6F17153656623A6D4681BE74EB253D9163422
Malicious:	false
Preview:	# Encoding file: iso8859-16, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B.00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C.00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF.0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF.00E000E100E2010300E4010700E600E700E

C:\ProgramData\assignee\tcl\encoding\iso8859-2.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.269412550127009
Encrypted:	false
SSDEEP:	24:UTUmJvRju3ShVbsZiAMiZyb7P4UPPssm0O4yT2H:UgmOEVIwAMiw/PTPss5tyT2H
MD5:	69FCA2E8F0FD9B39CDD908348BD2985E
SHA1:	FF62EB5710FDE11074A87DAEE9229BCF7F66D7A0
SHA-256:	0E0732480338A229CC3AD4CDDE09021A0A81902DC6EDFB5F12203E2AFF44668F
SHA-512:	46A7899D17810D2E0FF812078D91F29BF2BB8770F09A02367CF8361229F424FC9B06EAC8E3756491612972917463B6F27DB3D897AFAE8DB5F159D45975D9CBD8
Malicious:	false
Preview:	# Encoding file: iso8859-2, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B.00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D

C:\ProgramData\assignee\tcl\encoding\iso8859-3.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.178020305301999
Encrypted:	false
SSDEEP:	24:tTUmJvRju3ShVbsZiAMiZyb7P4UPp2g4kBTvSMkFtP0:tgmOEVIwAMiw/PTj4kBTvSDP0
MD5:	5685992A24D85E93BD8EA62755E327BA
SHA1:	B0BEBEDEC53FFB894D9FB0D57F25AB2A459B6DD5
SHA-256:	73342C27CF55F625D3DB90C5FC8E7340FFDF85A51872DBFB1D0A8CB1E43EC5DA
SHA-512:	E88ED02435026CA9B8A23073F61031F3A75C4B2CD8D2FC2B598F924ADF34B268AB16909120F1D96B794BDBC484C764FDE83B63C9FB122279AC5242D57030AF3A
Malicious:	false
Preview:	# Encoding file: iso8859-3, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B.00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C.00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF.000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF.00E000E100E2000000E4010B010900E700E8

C:\ProgramData\assignee\tcl\encoding\iso8859-4.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2703067063488724
Encrypted:	false
SSDEEP:	24:KTUmJvRju3ShVbsZiAMiZyb7P4UP04xsD/njwKyjhJ:KgmOEVIwAMiw/PT06s3fylJ
MD5:	07576E85AFDB2816BBCFFF80E2A12747
SHA1:	CC1C2E6C35B005C17EB7B1A3D744983A86A75736
SHA-256:	17745BDD299779E91D41DB0CEE26CDC7132DA3666907A94210B591CED5A55ADB
SHA-512:	309EEF25EE991E3321A57D2CEE139C9C3E7C8B3D9408664AAFE9BA34E28EF5FB8167481F3C5CAD0557AE55249E47016CA3A6AC19857D76EFB58D0CDAC428F600
Malicious:	false
Preview:	# Encoding file: iso8859-4, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF.00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A.01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF.010100E100E200E300E400E500E6012F010D

C:\ProgramData\assignee\tcl\encoding\iso8859-5.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2716690950473573
Encrypted:	false
SSDEEP:	24:zTUmJvRju3ShVbsZiAMiZyb7P4UPNXe+SAJlM9aHe3cmy+:zgmOEVIwAMiw/PTNp5+smy+
MD5:	67577E6720013EEF73923D3F050FBFA1
SHA1:	F9F64BB6014068E2C0737186C694B8101DD9575E
SHA-256:	BC5ED164D15321404BBDCAD0D647C322FFAB1659462182DBD3945439D9ECBAE7
SHA-512:	B584DB1BD5BE97CCFCA2F71E765DEC66CF2ABE18356C911894C988B2238E14074748C71074E0633C7CA50733E189D937160A35438C720DB2243CBC3566F52629
Malicious:	false
Preview:	# Encoding file: iso8859-5, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0040104020403040404050406040704080409040A040B040C00AD040E040F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.044004410442044304440445044604470448

C:\ProgramData\assignee\tcl\encoding\iso8859-6.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	2.9147595181616284
Encrypted:	false
SSDEEP:	24:YTUmJvRju3ShVbsZiAMiZyb7P4UPSIZjyco/rs:YgmOEVIwAMiw/PTBsBrs
MD5:	49DEC951C7A7041314DF23FE26C9B300
SHA1:	B810426354D857718CC841D424DA070EFB9F144F
SHA-256:	F502E07AE3F19CCDC31E434049CFC733DD5DF85487C0160B0331E40241AD0274
SHA-512:	CB5D8C5E807A72F35AD4E7DA80882F348D70052169A7ED5BB585152C2BF628177A2138BD0A982A398A8DF373E1D3E145AD1F6C52485DE57ECBE5A7ED33E13776
Malicious:	false
Preview:	# Encoding file: iso8859-6, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000000000000000A40000000000000000000000000000060C00AD00000000.00000000000000000000000000000000000000000000061B000000000000061F.0000062106220623062406250626062706280629062A062B062C062D062E062F.0630063106320633063406350636063706380639063A00000000000000000000.064006410642064306440645064606470648

C:\ProgramData\assignee\tcl\encoding\iso8859-7.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2933089629252037
Encrypted:	false
SSDEEP:	24:TMyTUmJvRju3ShVbsZiAMiZyb7P4UP1mKUQQSqJWeIDmq:TlgmOEVIwAMiw/PTkKJQSqJWeI1
MD5:	0AF65F8F07F623FA38E2D732400D95CF
SHA1:	D2903B32FEA225F3FB9239E622390A078C8A8FA6
SHA-256:	8FEC7631A69FCF018569EBADB05771D892678790A08E63C05E0007C9910D58A8
SHA-512:	EF03237A030C54E0E20DBA7ED724580C513490B9B3B043C1E885638E7BCE21415CE56C3902EA39689365B12E44194C6BF868C4D9BCBCA8FDC334BE77DA46E24D
Malicious:	false
Preview:	# Encoding file: iso8859-7, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A02018201900A30000000000A600A700A800A9000000AB00AC00AD00002015.00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B8

C:\ProgramData\assignee\tcl\encoding\iso8859-8.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	2.9730608214144323
Encrypted:	false
SSDEEP:	24:uTUmJvRju3ShVbsZiAMiZyb7P4UPtePly0b:ugmOEVIwAMiw/PTtw
MD5:	45E35EFF7ED2B2DF0B5694A2B639FE1E
SHA1:	4EA5EC5331541EDE65A9CF601F5418FD4B6CFCBC
SHA-256:	E1D207917AA3483D9110E24A0CC0CD1E0E5843C8BFC901CFEE7A6D872DD945A9
SHA-512:	527283C9EFF2C1B21FAE716F5DFB938D8294B22938C76A73D88135312FA01B5C3DF288461CCE8B692928B334A28A7D29319F9F48733174C898F41BD1BEB8E862
Malicious:	false
Preview:	# Encoding file: iso8859-8, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000002017.05D005D105D205D305D405D505D605D705D8

C:\ProgramData\assignee\tcl\encoding\iso8859-9.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.1865263857127375
Encrypted:	false
SSDEEP:	24:XTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkKMH+tZL/M:XgmOEVIwAMiw/PTvokKzR0
MD5:	675C89ECD212C8524B1875095D78A5AF
SHA1:	F585C70A5589DE39558DAC016743FF85E0C5F032
SHA-256:	1CDCF510C38464E5284EDCFAEC334E3FC516236C1CA3B9AB91CA878C23866914
SHA-512:	E620657C5F521A101B6FF7B5FD9A7F0DDD560166BA109D20E91F2E828F81697F897DFA136533C0D6F24A9861E92F34C0CC0FA590F344713C089157F8AC3ECFE2
Malicious:	false
Preview:	# Encoding file: iso8859-9, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E8

C:\ProgramData\assignee\tcl\encoding\jis0201.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	3.1984111069807395
Encrypted:	false
SSDEEP:	24:zBTUmJvRju3ShVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:zBgmOEVIwAMiw/PNPQPFj
MD5:	0DCB64ACBB4B518CC20F4E196E04692C
SHA1:	7AEB708C89C178FB4D5611C245EA1A7CF66ADF3A
SHA-256:	480F61D0E1A75DEE59BF9A66DE0BB78FAAE4E87FD6317F93480412123277D442
SHA-512:	4AFA210763DE9742626886D7D281AC15169CDC7A31D185F48D105190CA247AA014FB8F281AFCB4A0C31D2D55EE7D907B6A8E51FC4BEEDB9DB8C484E88CAA78A9
Malicious:	false
Preview:	# Encoding file: jis0201, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.00000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\jis0208.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	80459
Entropy (8bit):	2.275449965317654
Encrypted:	false
SSDEEP:	384:R7Cyeug/RAEo7umlshyGYknyRXglMVw9bq7bYI45zh2cvA3FXwhZ1BrUc2C5oS52:RgZJo7uNhbyO1ZiEXPcXwhZbrUPkBso+
MD5:	D8FD9D54F4497272592666B097384ACF
SHA1:	0F51A031132AF5CEB70D91E8795AD8F934EB0203
SHA-256:	8B3CAD181F3EB88B3E5B168EA48831C58A70DBC8F5DB37DF504E0FFD8B5AB985
SHA-512:	604084AF969C6426DEF4061EEF0C0E267B43AF25AE9F200164342F02CDE8931B0A2AAB46E42D0FAABEDE3AFFE23F993D3EBB76C560236434765A4A1FC7FB5A82
Malicious:	false
Preview:	# Encoding file: jis0208, double-byte.D.2129 0 77.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8.FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F.FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D.FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7.00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5.FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\jis0212.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	70974
Entropy (8bit):	2.2631380488363284
Encrypted:	false
SSDEEP:	768:WmU4+qNPpEzjKgGWJACVeCssX2Qt5E2+G7PBIv:LU4+qNaCgGW7VGK2o+0qv
MD5:	F518436AC485F5DC723518D7872038E0
SHA1:	15013478760463A0BCE3577B4D646ECDB07632B5
SHA-256:	24A9D379FDA39F2BCC0580CA3E0BD2E99AE279AF5E2841C9E7DBE7F931D19CC0
SHA-512:	2325705D4772A10CD81082A035BEAC85E6C64C7CCFA5981955F0B85CAF9A95D8A0820092957822A05C2E8E773F2089035ED5E76BF3FAF19B0E7E6AED7B4214D8
Malicious:	false
Preview:	# Encoding file: jis0212, double-byte.D.2244 0 68.22.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000000000000000000000002D8.02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000.0000000000A100A600BF00000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000BA00AA00A900AE2122.00A4211600000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\koi8-r.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.463428231669408
Encrypted:	false
SSDEEP:	24:KcJ5mTUmJvRju3ShVbsZiAMiZyb7PcSzm1XvRS3YcmchJQ3MAxSy:KmmgmOEVIwAMiw/Ptz8gBmRcAx5
MD5:	E66D42CB71669CA0FFBCDC75F6292832
SHA1:	366C137C02E069B1A93FBB5D64B9120EA6E9AD1F
SHA-256:	7142B1120B993D6091197574090FE04BE3EA64FFC3AD5A167A4B5E0B42C9F062
SHA-512:	6FBF7AF0302B4AA7EF925EFED7235E946EDA8B628AA204A8BBB0A3D1CB8C79DD37D9DD92A276AD14B55776FEBB3B55CF5881AC4013F95ED4E618E3B49771E8A5
Malicious:	false
Preview:	# Encoding file: koi8-r, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204512553255425552556255725582559255A255B255C255D255E.255F25602561040125622563256425652566256725682569256A256B256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041

C:\ProgramData\assignee\tcl\encoding\koi8-u.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.439504497428066
Encrypted:	false
SSDEEP:	24:K+TUmJvRju3ShVbsZiAMiZyb7PcSzmn3gXDRS3YcmchJQ3MAxSy:K+gmOEVIwAMiw/Ptz0KgBmRcAx5
MD5:	D722EFEA128BE671A8FDA45ED7ADC586
SHA1:	DA9E67F64EC4F6A74C60CB650D5A12C4430DCFF7
SHA-256:	BBB729B906F5FC3B7EE6694B208B206D19A9D4DC571E235B9C94DCDD4A323A2A
SHA-512:	FDF183C1A0D9109E21F7EEBC5996318AEDED3F87319A980C4E96BFE1D43593BDB693D181744C5C7E391A849783E3594234060A9F76116DE56F9592EF95979E63
Malicious:	false
Preview:	# Encoding file: koi8-u, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204510454255404560457255725582559255A255B0491255D255E.255F25602561040104032563040604072566256725682569256A0490256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041

C:\ProgramData\assignee\tcl\encoding\ksc5601.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92877
Entropy (8bit):	2.32911747373862
Encrypted:	false
SSDEEP:	768:XtWS2ymX62EztZ1Oyxk1uGtQPUNg0q+6XVfEFh:XtWnzEn1HxRQQPV0Eeh
MD5:	599CEA614F5C5D01CDFA433B184AA904
SHA1:	C2FFA427457B4931E5A92326F251CD3D671059B0
SHA-256:	0F8B530AD0DECBF8DD81DA8291B8B0F976C643B5A292DB84680B31ECFBE5D00A
SHA-512:	43D24B719843A21E3E1EDDFC3607B1B198542306C2EC8D621188CD39BA913D23678D39D12D8370CC1CE12828661AF0A5F14AD2B2BF99F62387C5E3E365BA1E75
Malicious:	false
Preview:	# Encoding file: ksc5601, double-byte.D.233F 0 89.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300200B72025202600A8300300AD20152225FF3C223C20182019.201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7.00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640.222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6.25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D.221D2235222B222C2208220B2286228722822283222A222922272228FFE20000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\macCentEuro.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3601842107710365
Encrypted:	false
SSDEEP:	24:8jTUmJvRju3ShVbsZiAMiZyb7P4ZVPJS82WcVDX1MPEd4RPMppJ8K:8jgmOEVIwAMiw/PsVoy24VMppiK
MD5:	CADFBF5A4C7CAD984294284D643E9CA3
SHA1:	16B51D017001688A32CB7B15DE6E7A49F28B76FD
SHA-256:	8F3089F4B2CA47B7AC4CB78375B2BFAC01268113A7C67D020F8B5B7F2C25BBDA
SHA-512:	3941ACA62CF59BF6857BA9C300B4236F18690DE1213BB7FCFA0EC87DCD71152849F1DEAFB470CA4BC2ACC2C0C13D7FD57661BFC053960ADD7570DE365AE7E63C
Malicious:	false
Preview:	# Encoding file: macCentEuro, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179.017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC.202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E.012F012A22642265012B0136220222110142013B013C013D013E0139013A0145.0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C.20132014201C201D2018201900F725CA014D0154015501582039203A01590156.01570160201A201E0161015A015B00C101

C:\ProgramData\assignee\tcl\encoding\macCroatian.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3293096097500965
Encrypted:	false
SSDEEP:	24:8ULyTUmJvRju3ShVbsZiAMiZyb7P4SNMdNxOZwl+KR8DklJyseQWkv:8ULygmOEVIwAMiw/P34+KR8DklEswm
MD5:	F13D479550D4967A0BC76A60C89F1461
SHA1:	63F44E818284384DE07AB0D8B0CD6F7EBFE09AB9
SHA-256:	8D0B6A882B742C5CCE938241328606C111DDA0CB83334EBEDCDA17605F3641AE
SHA-512:	80AB9DCAAC1A496FD2CA6BE9959FE2DE201F504D8A58D114F2FF5D1F6AAD507F052B87D29D3EBA69093C3D965CC4C113C9EA6DB8EEBB67BD620ADF860CA2CC35
Malicious:	false
Preview:	# Encoding file: macCroatian, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8.221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8.00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153.01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB.201300B7201A201E203000C2010700C101

C:\ProgramData\assignee\tcl\encoding\macCyrillic.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3482225358368565
Encrypted:	false
SSDEEP:	24:8dTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmh:8dgmOEVIwAMiw/Pr5NY3k9nsmh
MD5:	60FFC8E390A31157D8646AEAC54E58AE
SHA1:	3DE17B2A5866272602FB8E9C54930A4CD1F3B06C
SHA-256:	EB135A89519F2E004282DED21B11C3AF7CCB2320C9772F2DF7D1A4A1B674E491
SHA-512:	3644429A9BD42ADC356E1BD6FCFABEE120E851348B538A4FE4903B72A533174D7448A6C2DA71219E4CD5D0443C0475417D54C8E113005DF2CA20C608DE5E3306
Malicious:	false
Preview:	# Encoding file: macCyrillic, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.0430043104320433043404350436043704

C:\ProgramData\assignee\tcl\encoding\macDingbats.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.8086748658227827
Encrypted:	false
SSDEEP:	24:87JM0UmJvRjuyfqYCsUBOdXBCbtwHviANskNWkiXFtoE4OSFgHrBPkq:87KfmOEqYCs6CXRPiANHWkiXFt9XSMdf
MD5:	EBD121A4E93488A48FC0A06ADE9FD158
SHA1:	A40E6DB97D6DB2893A072B2275DC22E2A4D60737
SHA-256:	8FBCC63CB289AFAAE15B438752C1746F413F3B79BA5845C2EF52BA1104F8BDA6
SHA-512:	26879ABE4854908296F32B2BB97AEC1F693C56EC29A7DB9B63B2DA62282F2D2EDAE9D50738595D1530731DF5B1812719A74F50ADF521F80DD5067F3DF6A3517C
Malicious:	false
Preview:	# Encoding file: macDingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727

C:\ProgramData\assignee\tcl\encoding\macGreek.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.4271472017271556
Encrypted:	false
SSDEEP:	24:8dOTUmJvRju3ShVbsZiAMiZyb7P4Hlb7BMM2aSYjsSkUEkp1FsOSUTime:8kgmOEVIwAMiw/Pg7K23s0x1FsOJTime
MD5:	14AD68855168E3E741FE179888EA7482
SHA1:	9C2AD53D69F5077853A05F0933330B5D6F88A51C
SHA-256:	F7BFF98228DED981EC9A4D1D0DA62247A8D23F158926E3ACBEC3CCE379C998C2
SHA-512:	FB13F32197D3582BC20EEA604A0B0FD7923AE541CCEB3AF1CDE36B0404B8DB6312FB5270B40CBC8BA4C91B9505B57FB357EB875E8AFB3DB76DFB498CE17851ED
Malicious:	false
Preview:	# Encoding file: macGreek, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8.00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC.2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7.039100B12264226500A503920395039603970399039A039C03A603AB03A803A9.03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153.20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F.03CD03B103B203C803B403B503C603B303B70

C:\ProgramData\assignee\tcl\encoding\macIceland.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.3292041026777457
Encrypted:	false
SSDEEP:	24:8KTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjY4g4JysAWD:8KgmOEVIwAMiw/Pf2YRMFBEszD
MD5:	6D52A84C06970CD3B2B7D8D1B4185CE6
SHA1:	C434257D76A9FDF81CCCD8CC14242C8E3940FD89
SHA-256:	633F5E3E75BF1590C94AB9CBF3538D0F0A7A319DB9016993908452D903D9C4FD
SHA-512:	711F4DC86DD609823BF1BC5505DEE9FA3875A8AA7BCA31DC1B5277720C5ABE65B62E8A592FC55D99D1C7CA181FDDC2606551C43A9D12489B9FECFF152E9A3DCF
Malicious:	false
Preview:	# Encoding file: macIceland, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE.00FD00B7201A201E203000C200CA00C100C

C:\ProgramData\assignee\tcl\encoding\macJapan.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48028
Entropy (8bit):	3.3111639331656635
Encrypted:	false
SSDEEP:	768:ehuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtHJ:eZPV9KuqTxFGXp
MD5:	105B49F855C77AE0D3DED6C7130F93C2
SHA1:	BA187C52FAE9792DA5BFFBEAA781FD4E0716E0F6
SHA-256:	2A6856298EC629A16BDD924711DFE3F3B1E3A882DDF04B7310785D83EC0D566C
SHA-512:	5B5FBE69D3B67AF863759D92D4A68481EC2211FF84ED9F0B3BD6129857966DE32B42A42432C44B9246C9D0D9C4C546CD3C6D13FF49BD338192C24AD053C0602E
Malicious:	false
Preview:	# Encoding file: macJapan, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\macRoman.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.3361385497578406
Encrypted:	false
SSDEEP:	24:8TTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjBtRg4JysAWD:8TgmOEVIwAMiw/P32YRMTtRBEszD
MD5:	30BECAE9EFD678B6FD1E08FB952A7DBE
SHA1:	E4D8EA6A0E70BB793304CA21EB1337A7A2C26A31
SHA-256:	68F22BAD30DAA81B215925416C1CC83360B3BB87EFC342058929731AC678FF37
SHA-512:	E87105F7A5A983ACEAC55E93FA802C985B2B19F51CB3C222B4C13DDCF17C32D08DF323C829FB4CA33770B668485B7D14B7F6B0CF2287B0D76091DE2A675E88BD
Malicious:	false
Preview:	# Encoding file: macRoman, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02.202100B7201A201E203000C200CA00C100CB0

C:\ProgramData\assignee\tcl\encoding\macRomania.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.342586490827578
Encrypted:	false
SSDEEP:	24:8tTUmJvRju3ShVbsZiAMiZyb7P4SNMVZSxOZFYRMdj/TAg4JysAWD:8tgmOEVIwAMiw/P3AtYRMFTABEszD
MD5:	C9AD5E42DA1D2C872223A14CC76F1D2B
SHA1:	E257BD16EF34FDC29D5B6C985A1B45801937354C
SHA-256:	71AE80ADFB437B7BC88F3C76FD37074449B3526E7AA5776D2B9FD5A43C066FA8
SHA-512:	74588523D35A562AD4B1AF2B570596194D8C5018D5B44C8BA2B1F6BAD422D06E90172B0E65BB975663F3A3C246BCF2F598E9778BA86D1C5A51F5C0A38A2670EC
Malicious:	false
Preview:	# Encoding file: macRomania, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E.221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163.202100B7201A201E203000C200CA00C100C

C:\ProgramData\assignee\tcl\encoding\macThai.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	3.539905812302991
Encrypted:	false
SSDEEP:	24:88TUmJvRju3ShVbsZiAMiZyb7P4oJi8XPHmED43U/Tmh:88gmOEVIwAMiw/PNJpP43U0
MD5:	163729C7C2B1F5A5DE1FB7866C93B102
SHA1:	633D190B5E281CFC0178F6C11DD721C6A266F643
SHA-256:	CEAD5EB2B0B44EF4003FBCB2E49CA0503992BA1D6540D11ACBBB84FDBBD6E79A
SHA-512:	2093E3B59622E61F29276886911FAA50BA3AA9D903CAF8CB778A1D3FDB3D1F7DA43071AFC3672C27BE175E7EEBBC542B655A85533F41EA39F32E80663CAF3B44
Malicious:	false
Preview:	# Encoding file: macThai, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899.FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F.0E400E410E420E430E440E450E460E470E480E

C:\ProgramData\assignee\tcl\encoding\macTurkish.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.353168947106635
Encrypted:	false
SSDEEP:	24:8QjTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdD/g4JysD:88gmOEVIwAMiw/P32YRM9BEsD
MD5:	F20CBBE1FF9289AC4CBAFA136A9D3FF1
SHA1:	382E34824AD8B79EF0C98FD516750649FD94B20A
SHA-256:	F703B7F74CC6F5FAA959F51C757C94623677E27013BCAE23BEFBA01A392646D9
SHA-512:	23733B711614EA99D954E92C6035DAC1237866107FE11CDD5B0CD2A780F22B9B7B879570DB38C6B9195F54DAD9DFB0D60641AB37DFF3C51CF1A11D1D36471B2D
Malicious:	false
Preview:	# Encoding file: macTurkish, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F.202100B7201A201E203000C200CA00C100C

C:\ProgramData\assignee\tcl\encoding\macUkraine.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.3460856516901947
Encrypted:	false
SSDEEP:	24:8TzTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmq:8PgmOEVIwAMiw/Pr5NY3k9nsmq
MD5:	92716A59D631BA3A352DE0872A5CF351
SHA1:	A487946CB2EFD75FD748503D75E495720B53E5BC
SHA-256:	4C94E7FBE183379805056D960AB624D78879E43278262E4D6B98AB78E5FEFEA8
SHA-512:	863A667B6404ED02FE994089320EB0ECC34DC431D591D661277FB54A2055334DBEBCAAE1CA06FB8D190727EBA23A47B47991323BE35E74C182F83E5DEAA0D83B
Malicious:	false
Preview:	# Encoding file: macUkraine, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.04300431043204330434043504360437043

C:\ProgramData\assignee\tcl\encoding\shiftjis.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41862
Entropy (8bit):	3.4936148161949747
Encrypted:	false
SSDEEP:	768:/huW1PJnT9TOZRaQiPCLUKr7KBi9FrOLdtY:/ZPV9KoqTxFGXY
MD5:	8FBCB1BBC4B59D6854A8FCBF25853E0D
SHA1:	2D56965B24125D999D1020C7C347B813A972647C
SHA-256:	7502587D52E7810228F2ECB45AC4319EA0F5C008B7AC91053B920010DC6DDF94
SHA-512:	128E66F384F9EA8F3E7FBEAD0D3AA1D45570EB3669172269A89AE3B522ED44E4572C6A5C9281B7E219579041D14FF0E76777A36E3902BFA1B58DC3DA729FA075
Malicious:	false
Preview:	# Encoding file: shiftjis, multi-byte.M.003F 0 40.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086008700000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000

C:\ProgramData\assignee\tcl\encoding\symbol.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.675943323650254
Encrypted:	false
SSDEEP:	24:Sd0UmJvRjuLoVoMQVoRmSdsTAsSnP9Us+yw4VivXObCXv:afmOEVoMQVoRmosTHSP9U/ydmXwCXv
MD5:	1B612907F31C11858983AF8C009976D6
SHA1:	F0C014B6D67FC0DC1D1BBC5F052F0C8B1C63D8BF
SHA-256:	73FD2B5E14309D8C036D334F137B9EDF1F7B32DBD45491CF93184818582D0671
SHA-512:	82D4A8F9C63F50E5D77DAD979D3A59729CD2A504E7159AE3A908B7D66DC02090DABD79B6A6DC7B998C32C383F804AACABC564A5617085E02204ADF0B13B13E5B
Malicious:	false
Preview:	# Encoding file: symbol, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002122000023220300250026220D002800292217002B002C2212002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.22450391039203A70394039503A603930397039903D1039A039B039C039D039F.03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F.F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF.03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.000003D2203222642044221E0192266326662665266021942190219121922193.00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5.21352111211C21182297229522052229222A2283228722842282228622082209.2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3.22C42329F8E8F8E9F8EA2211F8EBF8ECF8EDF8E

C:\ProgramData\assignee\tcl\encoding\tis-620.enc

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	2.9763240350841884
Encrypted:	false
SSDEEP:	24:ZlTUmJvRju3ShVbsZiAMiZyb7PNHmED43U/TW5dF:PgmOEVIwAMiw/PJ43UKF
MD5:	7273E998972C9EFB2CEB2D5CD553DE49
SHA1:	4AA47E6DF964366FA3C29A0313C0DAE0FA63A78F
SHA-256:	330517F72738834ECBF4B6FA579F725B4B33AD9F4669975E727B40DF185751FF
SHA-512:	56BF15C123083D3F04FE0C506EE8ECE4C08C17754F0CAAD3566F1469728CFD2F0A487023DCB26432240EB09F064944D3EF08175979F5D1D2BF734E7C7C609055
Malicious:	false
Preview:	# Encoding file: tis-620, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E

C:\ProgramData\assignee\tcl\history.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7328
Entropy (8bit):	4.804850018249122
Encrypted:	false
SSDEEP:	192:DXzSaH9ox71psyGb0XEACrHpff6Jy8qNy6QRIt5QYTLa3QAQYplavQqQIL0jZn:DpH9m71PnQdg+Q
MD5:	FFBCB8DF3C7A201F02F8FD8A2F994764
SHA1:	D7AC339F98605DD14BDFB4C91B1AF529D0AF445B
SHA-256:	1BC292D62B3808EC9A42FB59F37B87EBC1F2BF7F8C9720293C19957B586D3560
SHA-512:	60AFA83A872F6D315C89A41E17A8119F8676E1B3F6C58A88873F1A4AFF81D2A9D2EE97FAD5BE556B2F42B1A3D2E4FE22FF5F366617B58E476521A0051A4B3A8A
Malicious:	false
Preview:	# history.tcl --.#.# Implementation of the history command..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#...# The tcl::history array holds the history list and some additional.# bookkeeping variables..#.# nextid.the index used for the next history list item..# keep..the max size of the history list.# oldest.the index of the oldest item in the history...namespace eval ::tcl {. variable history. if {![info exists history]} {..array set history {.. nextid.0.. keep.20.. oldest.-20..}. }.. namespace ensemble create -command ::tcl::history -map {..add.::tcl::HistAdd..change.::tcl::HistChange..clear.::tcl::HistClear..event.::tcl::HistEvent..info.::tcl::HistInfo..keep.::tcl::HistKeep..nextid.::tcl::HistNextID..redo.::tcl::HistRedo. }.}...# history --.#.#.This is the main history command. See the man page for its interface..#.This does s

C:\ProgramData\assignee\tcl\http1.0\http.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9689
Entropy (8bit):	4.754346192989986
Encrypted:	false
SSDEEP:	192:kQkH8VqqNg5PPx7GRpoMJesrCL2coOG0vARQVSDR6VrKj7vWQYQN81QvLbDdv:pVqeglpu6toO3ACUnvv
MD5:	1DA12C32E7E4C040BD9AB2BCBAC5445B
SHA1:	8E8659BEF065AF9430509BBDD5FB4CFE0EF14153
SHA-256:	ACBFF9B5EF75790920B95023156FAD80B18AFF8CAFC4A6DC03893F9388E053A2
SHA-512:	A269C76C1684EC1A2E2AA611ABB459AA3BE2973FD456737BC8C8D2E5C8BC53A26BBC1488062281CA87E38D548281166C4D775C50C695AEC9741FE911BB431EAD
Malicious:	false
Preview:	# http.tcl.# Client-side HTTP for GET, POST, and HEAD commands..# These routines can be used in untrusted code that uses the Safesock.# security policy..# These procedures use a callback interface to avoid using vwait,.# which is not defined in the safe base..#.# See the http.n man page for documentation..package provide http 1.0..array set http {. -accept /. -proxyhost {}. -proxyport {}. -useragent {Tcl http client package 1.0}. -proxyfilter httpProxyRequired.}.proc http_config {args} {. global http. set options [lsort [array names http -*]]. set usage [join $options ", "]. if {[llength $args] == 0} {..set result {}..foreach name $options {.. lappend result $name $http($name)..}..return $result. }. regsub -all -- - $options {} options. set pat ^-([join $options \|])$. if {[llength $args] == 1} {..set flag [lindex $args 0]..if {[regexp -- $pat $flag]} {.. return $http($flag)..} else {.. return -code error "Unknown option $flag, must be:

C:\ProgramData\assignee\tcl\http1.0\pkgIndex.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	735
Entropy (8bit):	4.669068874824871
Encrypted:	false
SSDEEP:	12:jHxxYRs+opS42wyGlTajUA43KXks4L57+HkuRz20JSv6C3l5kl:bbYRshS42wyGlTah9XkbL5i1z2jxXkl
MD5:	10EC7CD64CA949099C818646B6FAE31C
SHA1:	6001A58A0701DFF225E2510A4AAEE6489A537657
SHA-256:	420C4B3088C9DACD21BC348011CAC61D7CB283B9BEE78AE72EED764AB094651C
SHA-512:	34A0ACB689E430ED2903D8A903D531A3D734CB37733EF13C5D243CB9F59C020A3856AAD98726E10AD7F4D67619A3AF1018F6C3E53A6E073E39BD31D088EFD4AF
Malicious:	false
Preview:	# Tcl package index file, version 1.0.# This file is generated by the "pkg_mkIndex" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}].

C:\ProgramData\assignee\tcl\init.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	24447
Entropy (8bit):	4.827975237300645
Encrypted:	false
SSDEEP:	384:S8Oh2gWD8Ud49ENkaacMQsRNLKx30ubLgAMOFaBBf6/9IrO1zWq8oXbjdEldQ7p7:MOD8Ud4IkaJfyuRMOFt/9IrOBWq8oXCA
MD5:	1017DC8F4FF0E4EE38EE5C15B589BA8A
SHA1:	57AC4B5AAF3136C4376BF3CFD73C0F6B49909854
SHA-256:	1DB1580E7F9CAC9533F831553036BA6ACECBF5584E422F7F58D7A25AE9EA78F3
SHA-512:	06EAB30670DD892CCA27F587C937A0977BA3732C791CBD818D52D9DB0A8080B385E22D2CD0004D2754AB3C3C1DE590ED01C7A754D8F3A7AD43C032B449417F6E
Malicious:	false
Preview:	# init.tcl --.#.# Default system startup file for Tcl-based applications. Defines.# "unknown" procedure and auto-load facilities..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-1999 Scriptics Corporation..# Copyright (c) 2004 by Kevin B. Kenny. All rights reserved..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# This test intentionally written in pre-7.5 Tcl .if {[info commands package] == ""} {. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]".}.package require -exact Tcl 8.6.1..# Compute the auto path to use in this interpreter..# The values on the path come from several locations:.#.# The environment variable TCLLIBPATH.#.# tcl_library, which is the directory containing this init.tcl script..# [tclInit] (Tcl_Init()) se

C:\ProgramData\assignee\tcl\msgs\af.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	989
Entropy (8bit):	4.015702624322247
Encrypted:	false
SSDEEP:	12:4EnLzu8wcm2NkKcmtH3WhvdfjESBToOqepFHvFgdF69dixmem1OMVjeza6O6c:4azu8DtkN3bbJ75pF9gG3U2e+gc
MD5:	3A3B4D3B137E7270105DC7B359A2E5C2
SHA1:	2089B3948F11EF8CE4BD3D57167715ADE65875E9
SHA-256:	2981965BD23A93A09EB5B4A334ACB15D00645D645C596A5ECADB88BFA0B6A908
SHA-512:	044602E7228D2CB3D0A260ADFD0D3A1F7CAB7EFE5DD00C7519EAF00A395A48A46EEFDB3DE81902D420D009B137030BC98FF32AD97E9C3713F0990FE6C09887A2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \. "So"\. "Ma"\. "Di"\. "Wo"\. "Do"\. "Vr"\. "Sa"]. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \. "Sondag"\. "Maandag"\. "Dinsdag"\. "Woensdag"\. "Donderdag"\. "Vrydag"\. "Saterdag"]. ::msgcat::mcset af MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset af MONTHS_FULL [list \. "Januarie"\. "Februarie"\. "Maart"\. "April"\. "Mei"\. "Junie"\. "Julie"\. "Augustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""]. ::msgcat::mcset af AM "VM". ::msgcat::mcset af PM "NM".}.

C:\ProgramData\assignee\tcl\msgs\af_za.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.879621059534584
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmouFygvNLouFqF3v6aZouFy9+3vR6HK:4EnLzu8YAgvNTYF3v6axAI3voq
MD5:	27C356DF1BED4B22DFA55835115BE082
SHA1:	677394DF81CDBAF3D3E735F4977153BB5C81B1A6
SHA-256:	3C2F5F631ED3603EF0D5BCB31C51B2353C5C27839C806A036F3B7007AF7F3DE8
SHA-512:	EE88348C103382F91F684A09F594177119960F87E58C5E4FC718C698AD436E332B74B8ED18DF8563F736515A3A6442C608EBCBE6D1BD13B3E3664E1AA3851076
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y". ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\ar.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1964
Entropy (8bit):	4.417722751563065
Encrypted:	false
SSDEEP:	24:4azu8fnkFewadQxvbkMPm/FiUoAwonC9UFsvSnvMq:46dw/L+C9cKSvF
MD5:	0A88A6BFF15A6DABAAE48A78D01CFAF1
SHA1:	90834BCBDA9B9317B92786EC89E20DCF1F2DBD22
SHA-256:	BF984EC7CF619E700FE7E00381FF58ABE9BD2F4B3DD622EB2EDACCC5E6681050
SHA-512:	85CB96321BB6FB3119D69540B9E76916F0C5F534BA01382E73F8F9A0EE67A7F1BFC39947335688F2C8F3DB9B51D969D8EA7C7104A035C0E949E8E009D4656288
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \. "\u062d"\. "\u0646"\. "\u062b"\. "\u0631"\. "\u062e"\. "\u062c"\. "\u0633"]. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar MONTHS_ABBREV [list \. "\u064a\u0646\u0627"\. "\u0641\u0628\u0631"\. "\u0645\u0627\u0631"\. "\u0623\u0628\u0631"\. "\u0645\u0627\u064a"\. "\u064a\u0648\u0646"\. "\u064a\u0648\u0644"\. "\u0623\u063a\u0633"\. "\u0633\u0628\u062a"\. "\u0623\u0643\u062a"\

C:\ProgramData\assignee\tcl\msgs\ar_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.825452591398057
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoKNvf/NLoKU3v6xH5oKNo+3vfXM6PYv:4EnLzu8yvf/Nq3v6vF3vfc6q
MD5:	EEB42BA91CC7EF4F89A8C1831ABE7B03
SHA1:	74D12B4CBCDF63FDF00E589D8A604A5C52C393EF
SHA-256:	29A70EAC43B1F3AA189D8AE4D92658E07783965BAE417FB66EE5F69CFCB564F3
SHA-512:	6CCB2F62986CE1CF3CE78538041A0E4AAF717496F965D73014A13E9B05093EB43185C3C14212DC052562F3F369AB6985485C8C93D1DFC60CF9B8DABEA7CDF434
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y". ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z".}.

C:\ProgramData\assignee\tcl\msgs\ar_jo.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.023830561129656
Encrypted:	false
SSDEEP:	24:4azu8J5Fe6k+wR+9Gb+Oa+UcP+wR+9Gb+Oa+UD:46I6CNbtdNbQ
MD5:	4338BD4F064A6CDC5BFED2D90B55D4E8
SHA1:	709717BB1F62A71E94D61056A70660C6A03B48AE
SHA-256:	78116E7E706C7D1E3E7446094709819FB39A50C2A2302F92D6A498E06ED4A31B
SHA-512:	C63A535AD19CBEF5EFC33AC5A453B1C503A59C6CE71A4CABF8083BC516DF0F3F14D3D4F309D33EDF2EC5E79DB00ED1F7D56FD21068F09F178BB2B191603BAC25
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\ProgramData\assignee\tcl\msgs\ar_lb.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.020656526954981
Encrypted:	false
SSDEEP:	24:4azu865Fehk+wR+9Gb+Oa+UXP+wR+9Gb+Oa+UD:46nhCNbadNbQ
MD5:	3789E03CF926D4F12AFD30FC7229B78D
SHA1:	AEF38AAB736E5434295C72C14F38033AAFE6EF15
SHA-256:	7C970EFEB55C53758143DF42CC452A3632F805487CA69DB57E37C1F478A7571B
SHA-512:	C9172600703337EDB2E36D7470A3AED96CCC763D7163067CB19E7B097BB7877522758C3109E31D5D72F486DD50BF510DDBA50EDD248B899FA0A2EEF09FCBF903
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\ProgramData\assignee\tcl\msgs\ar_sy.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.02203966019266
Encrypted:	false
SSDEEP:	24:4azu8k5Fezk+wR+9Gb+Oa+U5P+wRa9Gb+Oa+UD:46ZzCNb0d5bQ
MD5:	EC736BFD4355D842E5BE217A7183D950
SHA1:	C6B83C02F5D4B14064D937AFD8C6A92BA9AE9EFB
SHA-256:	AEF17B94A0DB878E2F0FB49D982057C5B663289E3A8E0E2B195DCEC37E8555B1
SHA-512:	68BB7851469C24003A9D74FC7FE3599A2E95EE3803014016DDEBF4C5785F49EDBADA69CD4103F2D3B6CE91E9A32CC432DBDFEC2AED0557E5B6B13AED489A1EDA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\ProgramData\assignee\tcl\msgs\be.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.215818273236158
Encrypted:	false
SSDEEP:	48:46dJRQPQ86AK0xQuEQS3oQsDptuCrQICZmQ8ZVDtN1QFqQLtCSjZMpktvp:hdP6HIZoFnl1Rgx
MD5:	1A3ABFBC61EF757B45FF841C197BB6C3
SHA1:	74D623DAB6238D05C18DDE57FC956D84974FC2D4
SHA-256:	D790E54217A4BF9A7E1DCB4F3399B5861728918E93CD3F00B63F1349BDB71C57
SHA-512:	154D053410AA0F7817197B7EE1E8AE839BA525C7660620581F228477B1F5B972FE95A4E493BB50365D0B63B0115036DDE54A98450CA4E8048AF5D0AF092BADE5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0430\u0442"\. "\u0441\u0440"\. "\u0447\u0446"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\. "\u0441\u0435\u0440\u0430\u0434\u0430"\. "\u0447\u0430\u0446\u0432\u0435\u0440"\. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset be MONTHS_ABBREV [list \. "\u0441\u0442\u0434"\. "\u043b\u044e\u0442"\. "\u0441\u043a\u0432"\. "\u043a\u0440\u0441"\. "\u043c\u0430\u0439"\. "\u0447\u0440\u0432"\. "\u043b\u043f\u043d"\. "\u0436\u043d\u

C:\ProgramData\assignee\tcl\msgs\bg.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	4.363233187157474
Encrypted:	false
SSDEEP:	48:46scAXuQfuQVoQAWN5EPIKfD8WQjQ3QgQaQLSqQsQGtQWCQMmt1f:hD/zQaPIKfTSiF3KVfVCqp
MD5:	11FA3BA30A0EE6A7B2B9D67B439C240D
SHA1:	EC5557A16A0293ABF4AA8E5FD50940B60A8A36A6
SHA-256:	E737D8DC724AA3B9EC07165C13E8628C6A8AC1E80345E10DC77E1FC62A6D86F1
SHA-512:	B776E7C98FB819436C61665206EE0A2644AA4952D739FF7CC58EAFBD549BD1D26028DE8E11B8533814102B31FC3884F95890971F547804BCAA4530E35BDD5CFD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0434"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u043b\u044f"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0421\u0440\u044f\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\. "\u041f\u0435\u0442\u044a\u043a"\. "\u0421\u044a\u0431\u043e\u0442\u0430"]. ::msgcat::mcset bg MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset bg MONTHS_FULL [list \. "\u042

C:\ProgramData\assignee\tcl\msgs\bn.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	4.04505151160981
Encrypted:	false
SSDEEP:	24:4azu8adWa9tUEVcqVc5VcaUTVcHVEVc+7VclEVcNGVcn0VcMG/0VcMjVcMK7YXs+:46C07LetHigetH1YES
MD5:	B387D4A2AB661112F2ABF57CEDAA24A5
SHA1:	80DB233687A9314600317AD39C01466C642F3C4C
SHA-256:	297D4D7CAE6E99DB3CA6EE793519512BFF65013CF261CF90DED4D28D3D4F826F
SHA-512:	450BB56198AAAB2EEFCD4E24C29DD79D71D2EF7E8D066F3B58F9C5D831F960AFB78C46ECE2DB32EF81454BCCC80C730E36A610DC9BAF06757E0757B421BACB19
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \. "\u09b0\u09ac\u09bf"\. "\u09b8\u09cb\u09ae"\. "\u09ae\u0999\u0997\u09b2"\. "\u09ac\u09c1\u09a7"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\. "\u09b6\u09c1\u0995\u09cd\u09b0"\. "\u09b6\u09a8\u09bf"]. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"]. ::msgcat::mcset bn MONTHS_ABBREV [list \. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be\u09b0\u09c0"\.

C:\ProgramData\assignee\tcl\msgs\bn_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.821338044395148
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmovtvflD/Lo/E3v6xH5ovto+3vflm6PYv:4EnLzu81tvflD/SE3v6etF3vflm6q
MD5:	764E70363A437ECA938DEC17E615608B
SHA1:	2296073AE8CC421780E8A3BCD58312D6FB2F5BFC
SHA-256:	7D3A956663C529D07C8A9610414356DE717F3A2A2CE9B331B052367270ACEA94
SHA-512:	4C7B9082DA9DDF07C2BE16C359A1A42834B8E730AD4DD5B987866C2CC735402DDE513588A89C8DFA25A1AC6F66AF9FDDBEA8FD500F8526C4641BBA7011CD0D28
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.

C:\ProgramData\assignee\tcl\msgs\ca.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.213250101046006
Encrypted:	false
SSDEEP:	24:4azu8WBVUUQ48wsF0nuLsCtJeUFqwv1v3:46BwoL5ScfR3
MD5:	9378A5AD135137759D46A7CC4E4270E0
SHA1:	8D2D53DA208BB670A335C752DFC4B4FF4509A799
SHA-256:	14FF564FAB584571E954BE20D61C2FACB096FE2B3EF369CC5ECB7C25C2D92D5A
SHA-512:	EF784D0D982BA0B0CB37F1DA15F8AF3BE5321F59E586DBED1EDD0B3A38213D3CEA1CDFC983A025418403400CCE6039B786EE35694A5DFCE1F22CB2D315F5FCF8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \. "dg."\. "dl."\. "dt."\. "dc."\. "dj."\. "dv."\. "ds."]. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \. "diumenge"\. "dilluns"\. "dimarts"\. "dimecres"\. "dijous"\. "divendres"\. "dissabte"]. ::msgcat::mcset ca MONTHS_ABBREV [list \. "gen."\. "feb."\. "mar\u00e7"\. "abr."\. "maig"\. "juny"\. "jul."\. "ag."\. "set."\. "oct."\. "nov."\. "des."\. ""]. ::msgcat::mcset ca MONTHS_FULL [list \. "gener"\. "febrer"\. "mar\u00e7"\. "abril"\. "maig"\. "juny"\. "juliol"\. "agost"\. "setembre"\. "octubre"\. "novembre"\. "desembre"\. ""]. ::msgcat::mcset ca DATE_FORMAT "%d/%m/%Y". ::msg

C:\ProgramData\assignee\tcl\msgs\cs.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	4.400184537938628
Encrypted:	false
SSDEEP:	24:4azu8f4sO4fETEtd3N5EPIK+kJQz3R3VJ2PYYITCF3eYGCvt2/v3eG:46/ETKN5EPIKfsxV+pBtMJ
MD5:	4C5679B0880394397022A70932F02442
SHA1:	CA5C47A76CD4506D8E11AECE1EA0B4A657176019
SHA-256:	49CF452EEF0B8970BC56A7B8E040BA088215508228A77032CBA0035522412F86
SHA-512:	39FA0D3235FFD3CE2BCCFFFA6A4A8EFE2668768757DAFDE901917731E20AD15FCAC4E48CF4ACF0ADFAA38CC72768FD8F1B826464B0F71A1C784E334AE72F857C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "\u00dat"\. "St"\. "\u010ct"\. "P\u00e1"\. "So"]. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \. "Ned\u011ble"\. "Pond\u011bl\u00ed"\. "\u00dater\u00fd"\. "St\u0159eda"\. "\u010ctvrtek"\. "P\u00e1tek"\. "Sobota"]. ::msgcat::mcset cs MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset cs MONTHS_FULL [list \. "leden"\. "\u00fanor"\. "b\u0159ezen"\. "duben"\. "kv\u011bten"\. "\u010derven"\. "\u010dervenec"\. "srpen"\. "z\u00e1\u0159\u00ed"\. "\u0159\u00edjen"\. "listopad"\. "prosinec"\. ""]

C:\ProgramData\assignee\tcl\msgs\da.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	4.242018456508518
Encrypted:	false
SSDEEP:	24:4azu8xVKE6V4/xPsS9CfXTBfijQT1GqAPwvsvT:461H6y/RsJXTNGqAuKT
MD5:	F012F45523AA0F8CFEACC44187FF1243
SHA1:	B171D1554244D2A6ED8DE17AC8000AA09D2FADE9
SHA-256:	CA58FF5BAA9681D9162E094E833470077B7555BB09EEE8E8DD41881B108008A0
SHA-512:	5BBC44471AB1B1622FABC7A12A8B8727087BE64BEAF72D2C3C9AAC1246A41D9B7CAFC5C451F24A3ACC681C310BF47BBC3384CF80EB0B4375E12646CB7BB8FFD5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset da MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset da MONTHS_FULL [list \. "januar"\. "februar"\. "marts"\. "april"\. "maj"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset da BCE "f.Kr.". ::msgcat::mcset da CE "e.Kr.".

C:\ProgramData\assignee\tcl\msgs\de.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1222
Entropy (8bit):	4.277486792653572
Encrypted:	false
SSDEEP:	24:4azu8byFouxpZzWsu0biMe5pF9g1tT9egQTqrS8QWmWFUvIvWI3:46CFB/ZzWsu0vpHlrS8QLWFSeWI3
MD5:	68882CCA0886535A613ECFE528BB81FC
SHA1:	6ABF519F6E4845E6F13F272D628DE97F2D2CD481
SHA-256:	CC3672969C1DD223EADD9A226E00CAC731D8245532408B75AB9A70E9EDD28673
SHA-512:	ACD5F811A0494E04A18035D2B9171FAF3AB8C856AAB0C09AEBE755590261066ADCD2750565F1CB840B2D0111D95C98970294550A4FBD00E4346D2EDBA3A5C957
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \. "So"\. "Mo"\. "Di"\. "Mi"\. "Do"\. "Fr"\. "Sa"]. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mrz"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de BCE "v. Chr.". ::msgcat::mcset de CE "n. Chr.".

C:\ProgramData\assignee\tcl\msgs\de_at.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	812
Entropy (8bit):	4.344116560816791
Encrypted:	false
SSDEEP:	12:4EnLzu8U3S5dkTo7eqepFHvFgt1BAI+5zS17eM5Qz3q6owjI9I3vd3v6B3v9dy:4azu8UlMe5pF9gXDT9egQTqr+rv1vivi
MD5:	63B8EBBA990D1DE3D83D09375E19F6AC
SHA1:	B7714AF372B4662A0C15DDBC0F80D1249CB1EEBD
SHA-256:	80513A9969A12A8FB01802D6FC3015712A4EFDDA64552911A1BB3EA7A098D02C
SHA-512:	638307C9B97C74BAF38905AC88E73B57F24282E40929DA43ADB74978040B818EFCC2EE2A377DFEB3AC9050800536F2BE1C7C2A7AB9E7B8BCF8D15E5F293F24D9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_AT MONTHS_ABBREV [list \. "J\u00e4n"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_AT MONTHS_FULL [list \. "J\u00e4nner"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset de_AT TIME_FORMAT "%T". ::msgcat::mcset de_AT TIME_FORMAT_12 "%T". ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\de_be.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1223
Entropy (8bit):	4.319193323810203
Encrypted:	false
SSDEEP:	24:4azu8I8VWRFFAVa8VpZzWsuEbkMe5pF9grtT9egQTqr9u5sevOevmDvi:46kR6VaIZzWsuEJnHlrg5soOomzi
MD5:	A741CF1A27C77CFF2913076AC9EE9DDC
SHA1:	DE519D3A86DCF1E8F469490967AFE350BAEAFE01
SHA-256:	7573581DEC27E90B0C7D34057D9F4EF89727317D55F2C4E0428A47740FB1EB7A
SHA-512:	C9272793BAA1D33C32576B48756063F4A9BB97E8FFA276809CF4C3956CC457E48C577BDF359C1ECF5CF665A68135CAED17E972DC053A6AFBAAC3BA0ECBAFEB05
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \. "Son"\. "Mon"\. "Die"\. "Mit"\. "Don"\. "Fre"\. "Sam"]. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de_BE MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_BE MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_BE AM "vorm". ::msgcat::mcs

C:\ProgramData\assignee\tcl\msgs\el.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2252
Entropy (8bit):	4.313031807335687
Encrypted:	false
SSDEEP:	24:4azu8+v+39bYW4v+0Wn4Obg+EKkJQg9UWWY+YcYGV97Wu9TJGJABRF6RrJFdsvjt:468XxCSpAWL8jdL
MD5:	E152787B40C5E30699AD5E9B0C60DC07
SHA1:	4FB9DB6E784E1D28E632B55ED31FBBB4997BF575
SHA-256:	9B2F91BE34024FBCF645F6EF92460E5F944CA6A16268B79478AB904B2934D357
SHA-512:	DE59E17CAB924A35C4CC74FE8FCA4776BD49E30C224E476741A273A74BBE40CDAAEDBF6BBB5E30011CD0FEED6B2840F607FD0F1BD3E136E7FE39BAE81C7ED4DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \. "\u039a\u03c5\u03c1"\. "\u0394\u03b5\u03c5"\. "\u03a4\u03c1\u03b9"\. "\u03a4\u03b5\u03c4"\. "\u03a0\u03b5\u03bc"\. "\u03a0\u03b1\u03c1"\. "\u03a3\u03b1\u03b2"]. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\. "\u03a4\u03c1\u03af\u03c4\u03b7"\. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"]. ::msgcat::mcset el MONTHS_ABBREV [list \. "\u0399\u03b1\u03bd"\. "\u03a6\u03b5\u03b2"\. "\u039c\u03b1\u03c1"\. "\u0391\u03c0\u03c1"\. "\u039c\u03b1\u03ca"\. "\u0399\u03bf\u03c5\u03bd"\. "\u

C:\ProgramData\assignee\tcl\msgs\en_au.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.849761581276844
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoCwmGjbJFLoCws6W3vULoCws6W3v6p6HH5oCwmT+3vjb0y6:4EnLzu8brJFqs6W3v3s6W3v6QQJ3vK
MD5:	F8AE50E60590CC1FF7CCC43F55B5B8A8
SHA1:	52892EDDFA74DD4C8040F9CDD19A9536BFF72B6E
SHA-256:	B85C9A373FF0F036151432652DD55C182B0704BD0625EA84BED1727EC0DE3DD8
SHA-512:	8E15C9CA9A7D2862FDBA330F59BB177B06E5E3154CF3EA948B8E4C0282D66E75E18C225F28F6A203B4643E8BCAA0B5BDB59578A4C20D094F8B923650796E2E72
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\en_be.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.823881517188826
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoCr3FD/LoCsX3vtfNrFLoCsX3v6YNn5oCs+3v3FnN9:4EnLzu863FD/U3vtNm3v6yt3v3FnN9
MD5:	A0BB5A5CC6C37C12CB24523198B82F1C
SHA1:	B7A6B4BFB6533CC33A0A0F5037E55A55958C4DFC
SHA-256:	596AC02204C845AA74451FC527645549F2A3318CB63051FCACB2BF948FD77351
SHA-512:	9859D8680E326C2EB39390F3B96AC0383372433000A4E828CF803323AB2AB681B2BAE87766CB6FB23F6D46DBA38D3344BC4A941AFB0027C737784063194F9AE4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S". ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z". ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\en_bw.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.869619023232552
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmosmGvNLoss6W3v6aZosmT+3vR6HK:4EnLzu8WrvNbs6W3v6aBJ3voq
MD5:	ECC735522806B18738512DC678D01A09
SHA1:	EEEC3A5A3780DBA7170149C779180748EB861B86
SHA-256:	340804F73B620686AB698B2202191D69227E736B1652271C99F2CFEF03D72296
SHA-512:	F46915BD68249B5B1988503E50EBC48C13D9C0DDBDCBA9F520386E41A0BAAE640FD97A5085698AB1DF65640CE70AC63ED21FAD49AF54511A5543D1F36247C22D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\en_ca.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.828989678102087
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoAhgqH5oAZF3vGoAZF3v6loAh9+3vnFDLq:4EnLzu8mhgqHFZF3vGZF3v65hI3v9G
MD5:	F9A9EE00A4A2A899EDCCA6D82B3FA02A
SHA1:	BFDBAD5C0A323A37D5F91C37EC899B923DA5B0F5
SHA-256:	C9FE2223C4949AC0A193F321FC0FD7C344A9E49A54B00F8A4C30404798658631
SHA-512:	4E5471ADE75E0B91A02A30D8A042791D63565487CBCA1825EA68DD54A3AE6F1E386D9F3B016D233406D4B0B499B05DF6295BC0FFE85E8AA9DA4B4B7CC0128AD9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_CA TIME_FORMAT "%r". ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p". ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z".}.

C:\ProgramData\assignee\tcl\msgs\en_gb.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.84511182583436
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEbtvqH5oELE3vG5oELE3v6X5oEbto+3vnFDoAov:4EnLzu8ibtvqHBLE3v4LE3v6RbtF3v98
MD5:	07C16C81F1B59444508D0F475C2DB175
SHA1:	DEDBDB2C9ACA932C373C315FB6C5691DBEDEB346
SHA-256:	AE38AD5452314B0946C5CB9D3C89CDFC2AD214E146EB683B8D0CE3FE84070FE1
SHA-512:	F13333C975E6A0AD06E57C5C1908ED23C4A96008A895848D1E2FE7985001B2E5B9B05C4824C74EDA94E0CC70EC7CABCB103B97E54E957F986D8F277EEC3325B7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_GB TIME_FORMAT "%T". ::msgcat::mcset en_GB TIME_FORMAT_12 "%T". ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\en_hk.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.803235346516854
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoa/5oaQ9woaAx/G4FLoaYYW3v6aZoaAx/T+3v4x6HK:4EnLzu8cpZF4F7xW3v6ah/3v4Iq
MD5:	27B4185EB5B4CAAD8F38AE554231B49A
SHA1:	67122CAA8ECA829EC0759A0147C6851A6E91E867
SHA-256:	C9BE2C9AD31D516B508D01E85BCCA375AAF807D6D8CD7C658085D5007069FFFD
SHA-512:	003E5C1E2ECCCC48D14F3159DE71A5B0F1471275D4051C7AC42A3CFB80CAF651A5D04C4D8B868158211E8BC4E08554AF771993B0710E6625AA3AE912A33F5487
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_HK AM "AM". ::msgcat::mcset en_HK PM "PM". ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\en_ie.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.78446779523026
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoK6qH5oKi+3vG5oKi+3v6X5oKv+3vnFDoAov:4EnLzu8vqHr3vQ3v6O3v9dy
MD5:	30E351D26DC3D514BC4BF4E4C1C34D6F
SHA1:	FA87650F840E691643F36D78F7326E925683D0A8
SHA-256:	E7868C80FD59D18BB15345D29F5292856F639559CFFD42EE649C16C7938BF58D
SHA-512:	5AAC8A55239A909207E73EFB4123692D027F7728157D07FAFB629AF5C6DB84B35CF11411E561851F7CDB6F25AEC174E85A1982C4B79C7586644E74512F5FBDDA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_IE TIME_FORMAT "%T". ::msgcat::mcset en_IE TIME_FORMAT_12 "%T". ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\en_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.756550208645364
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoKr3v5oKrGaoKr5vvNLoKrw3vULoKr5o+3voA6:4EnLzu8si2vvNa3vuF3vo3
MD5:	1423A9CF5507A198580D84660D829133
SHA1:	70362593A2B04CF965213F318B10E92E280F338D
SHA-256:	71E5367FE839AFC4338C50D450F111728E097538ECACCC1B17B10238001B0BB1
SHA-512:	C4F1AD41D44A2473531247036BEEF8402F7C77A21A33690480F169F35E78030942FD31C9331A82B8377D094E22D506C785D0311DBB9F1C2B4AD3575B3F0E76E3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IN AM "AM". ::msgcat::mcset en_IN PM "PM". ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\en_nz.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.89415873600679
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoyejbJFLo63vULo63v6p6HH5oy7+3vjb0y6:4EnLzu8YeJFL3vI3v6QtS3vK
MD5:	DB734349F7A1A83E1CB18814DB6572E8
SHA1:	3386B2599C7C170A03E4EED68C39EAC7ADD01708
SHA-256:	812DB204E4CB8266207A4E948FBA3DD1EFE4D071BBB793F9743A4320A1CEEBE3
SHA-512:	EF09006552C624A2F1C62155251A18BDA9EE85C9FC81ABBEDE8416179B1F82AD0D88E42AB0A10B4871EF4B7DB670E4A824392339976C3C95FB31F588CDE5840D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\en_ph.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.775448167269054
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoJ5oXo2e4FLoe3v6aZo27+3v4x6HK:4EnLzu8l4Fj3v6aE3v4Iq
MD5:	787C83099B6E4E80AC81DD63BA519CBE
SHA1:	1971ACFAA5753D2914577DCC9EBDF43CF89C1D00
SHA-256:	BE107F5FAE1E303EA766075C52EF2146EF149EDA37662776E18E93685B176CDC
SHA-512:	527A36D64B4B5C909F69AA8609CFFEBBA19A378CEA618E1BB07EC2AED89E456E2292080C43917DF51B08534A1D0B35F2069008324C99A7688BBEDE49049CD8A2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_PH AM "AM". ::msgcat::mcset en_PH PM "PM". ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\en_sg.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.865159200607995
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoQW53FD/LoQGuX3v6ZhLoQWa+3v3F0fJ:4EnLzu8283FD/LJ3v6Xc3v3F4
MD5:	3045036D8F0663E26796E4E8AFF144E2
SHA1:	6C9066396C107049D861CD0A9C98DE8753782571
SHA-256:	B8D354519BD4EB1004EB7B25F4E23FD3EE7F533A5F491A46D19FD520ED34C930
SHA-512:	EBA6CD05BD596D0E8C96BBCA86379F003AD31E564D9CB90C906AF4B3A776AA797FC18EC405781F83493BBB33510DEDC0E78504AD1E6977BE0F83B2959AD25B8A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\en_za.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	4.89152584889677
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoOr0l5oOK3v6wLoOs+3v0l6C:4EnLzu8WL3v663vlC
MD5:	F285A8BA3216DA69B764991124F2F75A
SHA1:	A5B853A39D944DB9BB1A4C0B9D55AFDEF0515548
SHA-256:	98CE9CA4BB590BA5F922D6A196E5381E19C64E7682CDBEF914F2DCE6745A7332
SHA-512:	05695E29BA10072954BC91885A07D74EFBCB81B0DE3961261381210A51968F99CE1801339A05B810A54295E53B0A7E1D75CA5350485A8DEBFFFCBD4945234382
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d". ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S". ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\en_zw.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.888960668540414
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEmGvNLoEs6W3v6aZoEmT+3vR6HK:4EnLzu8urvNDs6W3v6a5J3voq
MD5:	D8878533B11C21445CAEFA324C638C7E
SHA1:	EFF82B28741FA16D2DFC93B5421F856D6F902509
SHA-256:	91088BBBF58A704185DEC13DBD421296BBD271A1AEBBCB3EF85A99CECD848FF8
SHA-512:	CBFD4FC093B3479AE9E90A5CA05EA1894F62DA9E0559ACC2BD37BBED1F0750ECFF13E6DF2078D68268192CA51A832E1BEED379E11380ADF3C91C1A01A352B20C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\eo.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	4.282246801138565
Encrypted:	false
SSDEEP:	24:4azu8CouOZBQpsS9C58mTXv8/s5pkPXvRvm:46nZ6psX8mT/cYpmfFm
MD5:	FE2F92E5C0AB19CDC7119E70187479F6
SHA1:	A14B9AA999C0BBD9B21E6A2B44A934D685897430
SHA-256:	50DF3E0E669502ED08DD778D0AFEDF0F71993BE388B0FCAA1065D1C91BD22D83
SHA-512:	72B4975DC2CAB725BD6557CAED41B9C9146E0DE167EE0A0723C3C90D7CF49FB1D749977042FFECBCD7D8F21509307AAB3CE80E3C51023D22072FB5B415801EA9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \. "di"\. "lu"\. "ma"\. "me"\. "\u0135a"\. "ve"\. "sa"]. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \. "diman\u0109o"\. "lundo"\. "mardo"\. "merkredo"\. "\u0135a\u016ddo"\. "vendredo"\. "sabato"]. ::msgcat::mcset eo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "a\u016dg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset eo MONTHS_FULL [list \. "januaro"\. "februaro"\. "marto"\. "aprilo"\. "majo"\. "junio"\. "julio"\. "a\u016dgusto"\. "septembro"\. "oktobro"\. "novembro"\. "decembro"\. ""]. ::msgcat::mcset eo BCE "aK". ::msgcat::mcset e

C:\ProgramData\assignee\tcl\msgs\es.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.216657382642579
Encrypted:	false
SSDEEP:	24:4azu8OJccwdQSBJr/S3tFA7C28/sF9AaD5rYrvtAvrG:46w3wdJB1/6FA22c49XrY7tWrG
MD5:	022CBA4FF73CF18D63D1B0C11D058B5D
SHA1:	8B2D0BE1BE354D639EC3373FE20A0F255E312EF6
SHA-256:	FFF2F08A5BE202C81E469E16D4DE1F8A0C1CFE556CDA063DA071279F29314837
SHA-512:	5142AD14C614E6BA5067B371102F7E81B14EB7AF3E40D05C674CFF1052DA4D172768636D34FF1DEE2499E43B2FEB4771CB1B67EDA10B887DE50E15DCD58A5283
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mi\u00e9"\. "jue"\. "vie"\. "s\u00e1b"]. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \. "domingo"\. "lunes"\. "martes"\. "mi\u00e9rcoles"\. "jueves"\. "viernes"\. "s\u00e1bado"]. ::msgcat::mcset es MONTHS_ABBREV [list \. "ene"\. "feb"\. "mar"\. "abr"\. "may"\. "jun"\. "jul"\. "ago"\. "sep"\. "oct"\. "nov"\. "dic"\. ""]. ::msgcat::mcset es MONTHS_FULL [list \. "enero"\. "febrero"\. "marzo"\. "abril"\. "mayo"\. "junio"\. "julio"\. "agosto"\. "septiembre"\. "octubre"\. "noviembre"\. "diciembre"\. ""]. ::msgcat::mcset es BCE "a.C.". ::msgcat::mcset es

C:\ProgramData\assignee\tcl\msgs\es_ar.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.830874390627383
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo8GUFLot/W3vULo8T+3v9y6:4EnLzu8KGUFN3v+K3v3
MD5:	C806EF01079E6B6B7EAE5D717DA2AAB3
SHA1:	3C553536241A5D2E95A3BA9024AAB46BB87FBAD9
SHA-256:	AF530ACD69676678C95B803A29A44642ED2D2F2D077CF0F47B53FF24BAC03B2E
SHA-512:	619905C2FB5F8D2BC2CBB9F8F0EA117C0AEFBDDE5E4F826FF962D7DC069D16D5DE12E27E898471DC6C039866FB64BBF62ED54DBC031E03C7D24FC2EA38DE5699
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S". ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\es_bo.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.878640071219599
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoYePWHFLoU3v6rZoY7+3vPUe6HK:4EnLzu8OegFp3v6rHS3vs3q
MD5:	4C2B2A6FBC6B514EA09AA9EF98834F17
SHA1:	853FFCBB9A2253B7DC2B82C2BFC3B132500F7A9D
SHA-256:	24B58DE38CD4CB2ABD08D1EDA6C9454FFDE7ED1A33367B457D7702434A0A55EE
SHA-512:	3347F9C13896AF19F6BAFBEF225AF2A1F84F20F117E7F0CE3E5CAA783FDD88ABDFAF7C1286AE421BC609A39605E16627013945E4ACA1F7001B066E14CAB90BE7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_cl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.889615718638578
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmodvPWHFLok3v6rZodo+3vPUe6HK:4EnLzu8DgF93v6rC3vs3q
MD5:	B7E7BE63F24FC1D07F28C5F97637BA1C
SHA1:	8FE1D17696C910CF59467598233D55268BFE0D94
SHA-256:	12AD1546EB391989105D80B41A87686D3B30626D0C42A73705F33B2D711950CC
SHA-512:	FD8B83EF06B1E1111AFF186F5693B17526024CAD8CC99102818BE74FD885344D2F628A0541ABB485F38DB8DE7E29EA4EE4B28D8E5F6ECEF826BABE1013ABDFB8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_co.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.862231219172699
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo4FjbJFLo4F+3v6rZo4++3vjb0f6HK:4EnLzu8QJFL+3v6rv3vbq
MD5:	FD946BE4D44995911E79135E5B7BD3BB
SHA1:	3BA38CB03258CA834E37DBB4E3149D4CDA9B353B
SHA-256:	1B4979874C3F025317DFCF0B06FC8CEE080A28FF3E8EFE1DE9E899F6D4F4D21E
SHA-512:	FBD8087891BA0AE58D71A6D07482EED5E0EA5C658F0C82A9EC67DFC0D826059F1FC6FF404D6A6DC9619BD9249D4E4EC30D828B177E0939302196C51FA9B2FC4B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_cr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.873281593259653
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo76GUFLoTW3v6rZo76T+3v9f6HK:4EnLzu8d6GUF73v6rq6K3vMq
MD5:	F08EF3582AF2F88B71C599FBEA38BFD9
SHA1:	456C90C09C2A8919DC948E86170F523062F135DB
SHA-256:	7AC5FC35BC422A5445603E0430236E62CCA3558787811DE22305F72D439EB4BB
SHA-512:	7187FC4CE0533F14BBA073039A0B86D610618573BA9A936CBE7682ED2939384C6BB9E0A407C016A42702E83627CCE394618ACB58419EA36908AA37F59165E371
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_do.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.8668686830029335
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmomerQZnFLou3v6rZom7+3vrQZg6HK:4EnLzu8xkZFH3v6rM3vkrq
MD5:	44F2EE567A3E9A021A3C16062CEAE220
SHA1:	180E938584F0A57AC0C3F85E6574BC48291D820E
SHA-256:	847C14C297DBE4D8517DEBAA8ED555F3DAEDF843D6BAD1F411598631A0BD3507
SHA-512:	BEB005D006E432963F9C1EF474A1E3669C8B7AF0681681E74DDA8FE9C8EE04D307EF85CF0257DA72663026138D38807A6ABA1255337CF8CC724ED1993039B40C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_ec.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.86970949384834
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmozgUFLoro+3v6rZoz9+3v9f6HK:4EnLzu8ZgUFcF3v6ruI3vMq
MD5:	CCB036C33BA7C8E488D37E754075C6CF
SHA1:	336548C8D361B1CAA8BDF698E148A88E47FB27A6
SHA-256:	2086EE8D7398D5E60E5C3048843B388437BD6F2507D2293CA218936E3BF61E59
SHA-512:	05058262E222653CF3A4C105319B74E07322AEE726CC11AEB2B562F01FF2476E3169EA829BF8B66E1B76617CB58E45423480E5A6CB3B3D4B33AA4DDDFA52D111
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_gt.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.86395314548955
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmohvjbJFLoI3v6rZoho+3vjb0f6HK:4EnLzu8PJFB3v6r23vbq
MD5:	1E6062716A094CC3CE1F2C97853CD3CD
SHA1:	499F69E661B3B5747227B31DE4539CAF355CCAAC
SHA-256:	1BC22AF98267D635E3F07615A264A716940A2B1FAA5CAA3AFF54D4C5A4A34370
SHA-512:	7C3FB65EC76A2F35354E93A47C3A59848170AAF504998CEF66AEBAAD39D303EC67BE212C6FACC98305E35FFEBF23CCB7E34396F11987E81D76B3685E6B5E89B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_hn.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.902544453689719
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoIvriP/FLoP3v6rZoIo+3vrig6HK:4EnLzu8w+nF+3v6rP3v+lq
MD5:	AAE4A89F6AB01044D6BA3511CBE6FE66
SHA1:	639A94279453B0028995448FD2E221C1BDE23CEE
SHA-256:	A2D25880C64309552AACED082DEED1EE006482A14CAB97DB524E9983EE84ACFC
SHA-512:	E2BE94973C931B04C730129E9B9746BB76E7AC7F5AAA8D7899903B8C86B4E3D4A955E9580CF2C64DE48AFD6A2A9386337C2F8A8128A511AFBFBBA09CC032A76E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_mx.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.863953145489551
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoPjbJFLoH+3v6rZoI+3vjb0f6HK:4EnLzu8NJF73v6rE3vbq
MD5:	F60290CF48AA4EDCA938E496F43135FD
SHA1:	0EE5A36277EA4E7A1F4C6D1D9EE32D90918DA25C
SHA-256:	D0FAA9D7997D5696BFF92384144E0B9DFB2E4C38375817613F81A89C06EC6383
SHA-512:	380DFCD951D15E53FCB1DEF4B892C8FD65CEFBF0857D5A7347FF3ED34F69ADD53AEEF895EDCFC6D2F24A65AB8F67CF813AEA2045EDBF3BF182BD0635B5ACB1A4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_ni.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.872124246425178
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoe/GriP/FLo3W3v6rZoe/T+3vrig6HK:4EnLzu8Ae+nFmW3v6rxS3v+lq
MD5:	2C4C45C450FEA6BA0421281F1CF55A2A
SHA1:	5249E31611A670EAEEF105AB4AD2E5F14B355CAE
SHA-256:	4B28B46981BBB78CBD2B22060E2DD018C66FCFF1CEE52755425AD4900A90D6C3
SHA-512:	969A4566C7B5FAF36204865D5BC22C849FBB44F0D16B04B9A9473B05DBABF22AEB9B77F282A44BB85D7E2A56C4E5BCE59E4E4CDEB3F6DD52AF47C65C709A3690
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_pa.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.860352858208512
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoX5rQZnFLoHE3v6rZoXa+3vrQZg6HK:4EnLzu8vkZF93v6rm3vkrq
MD5:	148626186A258E58851CC0A714B4CFD6
SHA1:	7F14D46F66D8A94A493702DCDE7A50C1D71774B2
SHA-256:	6832DC5AB9F610883784CF702691FCF16850651BC1C6A77A0EFA81F43BC509AC
SHA-512:	2B452D878728BFAFEA9A60030A26E1E1E44CE0BB26C7D9B8DB1D7C4F1AD3217770374BD4EDE784D0A341AB5427B08980FF4A62141FAF7024AB17296FE98427AC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_pe.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.8632965835916195
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoIgUFLoQ9X3v6rZoI9+3v9f6HK:4EnLzu8jUFZ3v6rS3vMq
MD5:	74F014096C233B4D1D38A9DFB15B01BB
SHA1:	75C28321AFED3D9CDA3EBF3FD059CDEA597BB13A
SHA-256:	CC826C93682EF19D29AB6304657E07802C70CF18B1E5EA99C3480DF6D2383983
SHA-512:	24E7C3914BF095B55DE7F01CB537E20112E10CF741333FD0185FEF0B0E3A1CD9651C2B2EDC470BCF18F51ADB352CA7550CFBF4F79342DCA33F7E0841AEDEBA8D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_pr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.859298425911738
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo06GriP/FLoeW3v6rZo06T+3vrig6HK:4EnLzu8ZG+nFy3v6rAK3v+lq
MD5:	AEB569C12A50B8C4A57C8034F666C1B3
SHA1:	24D8B096DD8F1CFA101D6F36606D003D4FCC7B4D
SHA-256:	19563225CE7875696C6AA2C156E6438292DE436B58F8D7C23253E3132069F9A2
SHA-512:	B5432D7A80028C3AD3A7819A5766B07EDB56CEE493C0903EDFA72ACEE0C2FFAA955A8850AA48393782471905FFF72469F508B19BE83CC626478072FFF6B60B5D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_py.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.871431420165191
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo/5UFLovE3v6rZo/a+3v9f6HK:4EnLzu8XUF13v6re3vMq
MD5:	D24FF8FAEE658DD516AC298B887D508A
SHA1:	61990E6F3E399B87060E522ABCDE77A832019167
SHA-256:	94FF64201C27AB04F362617DD56B7D85B223BCCA0735124196E7669270C591F0
SHA-512:	1409E1338988BC70C19DA2F6C12A39E311CF91F6BB759575C95E125EA67949F17BBE450B2CD29E3F6FDA1421C742859CB990921949C6940B34D7A8B8545FF8F0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_sv.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.883202808381857
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmofriP/FLo3+3v6rZoY+3vrig6HK:4EnLzu89+nFO+3v6rw3v+lq
MD5:	6A013D20A3C983639EAF89B93AB2037C
SHA1:	9ABEC22E82C1638B9C8E197760C66E370299BB93
SHA-256:	E3268C95E9B7D471F5FD2436C17318D5A796220BA39CEBEBCD39FBB0141A49CE
SHA-512:	C4FE0493A2C45DA792D0EE300EC1D30E25179209FE39ACCD74B23ACDFF0A72DEEEED1A1D12842101E0A4E57E8FEADF54F926347B6E9B987B70A52E0557919FC2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_uy.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.877844330421912
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmooygUFLooq9X3v6rZooy9+3v9f6HK:4EnLzu8SrUFzsX3v6rZJ3vMq
MD5:	40250432AD0DC4FF168619719F91DBCA
SHA1:	D38532CA84E80FE70C69108711E3F9A7DFD5230F
SHA-256:	BA557A3C656275A0C870FB8466F2237850F5A7CF2D001919896725BB3D3EAA4B
SHA-512:	26FB4B3332E2C06628869D4C63B7BAB4F42FF73D1D4FD8603323A93067F60D9505C70D1A14D7E34A9880E2993183FC09D43013F3BEB8BC48732F08181643D05D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\es_ve.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.882638228899482
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoXrUFLoXK3v6rZoXs+3v9f6HK:4EnLzu8VUFH3v6r83vMq
MD5:	F3A789CBC6B9DD4F5BA5182C421A9F78
SHA1:	7C2AF280C90B0104AB49B2A527602374254274CE
SHA-256:	64F796C5E3E300448A1F309A0DA7D43548CC40511036FF3A3E0C917E32147D62
SHA-512:	822C0D27D2A72C9D5336C1BCEDC13B564F0FB12146CF8D30FBE77B9C4728C4B3BF456AC62DACD2962A6B5B84761354B31CD505105EDB060BF202BA0B0A830772
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\et.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.321464868793769
Encrypted:	false
SSDEEP:	24:4azu8W1Yn1YZ1waUuvVTGiMiLpBgoVTJ01iLTh/w2SJmG5F1svtFmsv5d:46K1y1Mv9GrM9oc/FSJmG5F1KtFmK5d
MD5:	3B4BEE5DD7441A63A31F89D6DFA059BA
SHA1:	BEE39E45FA3A76B631B4C2D0F937FF6041E09332
SHA-256:	CCC2B4738DB16FAFB48BFC77C9E2F8BE17BC19E4140E48B61F3EF1CE7C9F3A8C
SHA-512:	AEC24C75CB00A506A46CC631A2A804C59FBE4F8EBCB86CBA0F4EE5DF7B7C12ED7D25845150599837B364E40BBFDB68244991ED5AF59C9F7792F8362A1E728883
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \. "P"\. "E"\. "T"\. "K"\. "N"\. "R"\. "L"]. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \. "p\u00fchap\u00e4ev"\. "esmasp\u00e4ev"\. "teisip\u00e4ev"\. "kolmap\u00e4ev"\. "neljap\u00e4ev"\. "reede"\. "laup\u00e4ev"]. ::msgcat::mcset et MONTHS_ABBREV [list \. "Jaan"\. "Veebr"\. "M\u00e4rts"\. "Apr"\. "Mai"\. "Juuni"\. "Juuli"\. "Aug"\. "Sept"\. "Okt"\. "Nov"\. "Dets"\. ""]. ::msgcat::mcset et MONTHS_FULL [list \. "Jaanuar"\. "Veebruar"\. "M\u00e4rts"\. "Aprill"\. "Mai"\. "Juuni"\. "Juuli"\. "August"\. "September"\. "Oktoober"\. "November"\. "Detsember"\. ""]. ::msgcat::mcset et

C:\ProgramData\assignee\tcl\msgs\eu.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	985
Entropy (8bit):	3.9137059580146376
Encrypted:	false
SSDEEP:	24:4azu80P6/XTPi6/XTotXSSzTGsy+trjz4HsKI:46qWKWoX75Bb4Mv
MD5:	E27FEB15A6C300753506FC706955AC90
SHA1:	FDFAC22CC0839B29799001838765EB4A232FD279
SHA-256:	7DCC4966A5C13A52B6D1DB62BE200B9B5A1DECBACCFCAF15045DD03A2C3E3FAA
SHA-512:	C54A0F72BC0DAF6A411466565467A2783690EA19F4D401A5448908944A0A6F3F74A7976FA0F851F15B6A97C6D6A3C41FB8BBC8EA42B5D5E3C17A5C8A37436FC5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \. "igandea"\. "astelehena"\. "asteartea"\. "asteazkena"\. "osteguna"\. "ostirala"\. "larunbata"]. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \. "igandea"\. "astelehena"\. "asteartea"\. "asteazkena"\. "osteguna"\. "ostirala"\. "larunbata"]. ::msgcat::mcset eu MONTHS_ABBREV [list \. "urt"\. "ots"\. "mar"\. "api"\. "mai"\. "eka"\. "uzt"\. "abu"\. "ira"\. "urr"\. "aza"\. "abe"\. ""]. ::msgcat::mcset eu MONTHS_FULL [list \. "urtarrila"\. "otsaila"\. "martxoa"\. "apirila"\. "maiatza"\. "ekaina"\. "uztaila"\. "abuztua"\. "iraila"\. "urria"\. "azaroa"\. "abendua"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\eu_es.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	4.8689948586471825
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoszFnJF+l6VALoszw3vG5oszw3v6X5osz++3v/R3v:4EnLzu8gL+l6Vt3vf3v6P3vZf
MD5:	D20788793E6CC1CD07B3AFD2AA135CB6
SHA1:	3503FCB9490261BA947E89D5494998CEBB157223
SHA-256:	935164A2D2D14815906B438562889B31139519B3A8E8DB3D2AC152A77EC591DC
SHA-512:	F65E7D27BD0A99918D6F21C425238000563C2E3A4162D6806EEAC7C9DCB9798987AFFB8BE01899D577078F6297AF468DBAEBEB6375C09ABF332EB44E328F0E8B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da". ::msgcat::mcset eu_ES TIME_FORMAT "%T". ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T". ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z".}.

C:\ProgramData\assignee\tcl\msgs\fa.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.1508548760580295
Encrypted:	false
SSDEEP:	24:4azu8BMnqZEjgYDT0/y3xg2LSREyqyxDfsycNp/Tpn29Ey5ykDDzi:46cGTYDT0/ya4KIySNnCz2
MD5:	7E74DE42FBDA63663B58B2E58CF30549
SHA1:	CB210740F56208E8E621A45D545D7DEFCAE8BCAF
SHA-256:	F9CA4819E8C8B044D7D68C97FC67E0F4CCD6245E30024161DAB24D0F7C3A9683
SHA-512:	A03688894BD44B6AB87DC6CAB0A5EC348C9117697A2F9D00E27E850F23EFDC2ADBD53CAC6B9ED33756D3A87C9211B6EE8DF06020F6DA477B9948F52E96071F76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \. "\u06cc\u2214"\. "\u062f\u2214"\. "\u0633\u2214"\. "\u0686\u2214"\. "\u067e\u2214"\. "\u062c\u2214"\. "\u0634\u2214"]. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\. "\u062f\u0648\u0634\u0646\u0628\u0647"\. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\. "\u062c\u0645\u0639\u0647"\. "\u0634\u0646\u0628\u0647"]. ::msgcat::mcset fa MONTHS_ABBREV [list \. "\u0698\u0627\u0646"\. "\u0641\u0648\u0631"\. "\u0645\u0627\u0631"\. "\u0622\u0648\u0631"\. "\u0645\u0640\u0647"\. "\u0698\u0648\u0646"\. "\u0698\u0648\u06cc"\. "\u0627\u0648\u062a"\. "\u0633\u067e\u

C:\ProgramData\assignee\tcl\msgs\fa_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.433104256056609
Encrypted:	false
SSDEEP:	24:4azu8XMnSZEjgYDT0g3xg2LSREyqyxDf5cNp/Tpn29Ey5ykDDzJ6v3Nev0Nv0f:46OeTYDT0ga4K9SNnCz0v9o0JI
MD5:	E6DBD1544A69BFC653865B723395E79C
SHA1:	5E4178E7282807476BD0D6E1F2E320E42FA0DE77
SHA-256:	6360CE0F31EE593E311B275F3C1F1ED427E237F31010A4280EF2C58AA6F2633A
SHA-512:	8D77DCB4333F043502CED7277AEEB0453A2C019E1A46826A0FE90F0C480A530F5646A4F76ECC1C15825601FC8B646ED7C78E53996E2908B341BA4ED1392B95F0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \. "\u06cc\u2214"\. "\u062f\u2214"\. "\u0633\u2214"\. "\u0686\u2214"\. "\u067e\u2214"\. "\u062c\u2214"\. "\u0634\u2214"]. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\. "\u062f\u0648\u0634\u0646\u0628\u0647"\. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\. "\u062c\u0645\u0639\u0647"\. "\u0634\u0646\u0628\u0647"]. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \. "\u0698\u0627\u0646"\. "\u0641\u0648\u0631"\. "\u0645\u0627\u0631"\. "\u0622\u0648\u0631"\. "\u0645\u0640\u0647"\. "\u0698\u0648\u0646"\. "\u0698\u0648\u06cc"\. "\u0627\u0648\u062a"\. "\u063

C:\ProgramData\assignee\tcl\msgs\fa_ir.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.087144086729547
Encrypted:	false
SSDEEP:	12:4EnLzu82vGz7AhF/Q3vf3v6TANv+K3vz7AA7:4azu8vPm/ivfvF9xvP9
MD5:	044BAAA627AD3C3585D229865A678357
SHA1:	9D64038C00253A7EEDA4921B9C5E34690E185061
SHA-256:	CF492CBD73A6C230725225D70566B6E46D5730BD3F63879781DE4433965620BE
SHA-512:	DA138F242B44111FAFE9EFE986EB987C26A64D9316EA5644AC4D3D4FEC6DF9F5D55F342FC194BC487A1B7C740F931D883A574863B48396D837D1E270B733F735
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d". ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631". ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y". ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H". ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P". ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z".}.

C:\ProgramData\assignee\tcl\msgs\fi.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	4.249302428029841
Encrypted:	false
SSDEEP:	24:4azu8ZeTWSS/DatuUSlWCBTtotL8W183eYKvt3v3eG:46sWp/DatBSPtoNmpMt/J
MD5:	34FE8E2D987FE534BD88291046F6820B
SHA1:	B173700C176336BD1B123C2A055A685F73B60C07
SHA-256:	BE0D2DCE08E6CD786BC3B07A1FB1ADC5B2CF12053C99EACDDAACDDB8802DFB9C
SHA-512:	4AC513F092D2405FEF6E30C828AE94EDBB4B0B0E1C68C1168EB2498C186DB054EBF697D6B55B49F865A2284F75B7D5490AFE7A80F887AE8312E6F9A5EFE16390
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \. "su"\. "ma"\. "ti"\. "ke"\. "to"\. "pe"\. "la"]. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \. "sunnuntai"\. "maanantai"\. "tiistai"\. "keskiviikko"\. "torstai"\. "perjantai"\. "lauantai"]. ::msgcat::mcset fi MONTHS_ABBREV [list \. "tammi"\. "helmi"\. "maalis"\. "huhti"\. "touko"\. "kes\u00e4"\. "hein\u00e4"\. "elo"\. "syys"\. "loka"\. "marras"\. "joulu"\. ""]. ::msgcat::mcset fi MONTHS_FULL [list \. "tammikuu"\. "helmikuu"\. "maaliskuu"\. "huhtikuu"\. "toukokuu"\. "kes\u00e4kuu"\. "hein\u00e4kuu"\. "elokuu"\. "syyskuu"\. "lokakuu"\. "marraskuu"\. "joulukuu"\. ""]. ::msgcat

C:\ProgramData\assignee\tcl\msgs\fo.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	986
Entropy (8bit):	4.07740021579371
Encrypted:	false
SSDEEP:	12:4EnLzu87mY5mvAqO6RxmtV5qHbMj6aywE1ZD4ScMfRDc6VZTEpSecbLwJQT1Y4:4azu874/RqEXsSpffTBtbQQT1t
MD5:	996B699F6821A055B826415446A11C8E
SHA1:	C382039ED7D2AE8D96CF2EA55FA328AE9CFD2F7D
SHA-256:	F249DD1698ED1687E13654C04D08B829193027A2FECC24222EC854B59350466A
SHA-512:	AB6F5ABC9823C7F7A67BA1E821680ACD37761F83CD1F46EC731AB2B72AA34C2E523ACE288E9DE70DB3D58E11F5CB42ECB5A5E4E39BFD7DFD284F1FF6B637E11D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \. "sun"\. "m\u00e1n"\. "t\u00fds"\. "mik"\. "h\u00f3s"\. "fr\u00ed"\. "ley"]. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nadagur"\. "t\u00fdsdagur"\. "mikudagur"\. "h\u00f3sdagur"\. "fr\u00edggjadagur"\. "leygardagur"]. ::msgcat::mcset fo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset fo MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "apr\u00edl"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\fo_fo.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.816022066048386
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoZA4HFLoZd3vG5oZd3v6X5oZd+3vnFDoAov:4EnLzu8kyFO3vf3v6f3v9dy
MD5:	A76D09A4FA15A2C985CA6BDD22989D6A
SHA1:	E6105EBCDC547FE2E2FE9EDDC9C573BBDAD85AD0
SHA-256:	7145B57AC5C074BCA968580B337C04A71BBD6EFB93AFAF291C1361FD700DC791
SHA-512:	D16542A1CCDC3F5C2A20300B7E38F43F94F7753E0E99F08EB7240D4F286B263815AD481B29F4E96F268E24BA17C5E135E356448685E1BF65B2B63CE6146AA54C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y". ::msgcat::mcset fo_FO TIME_FORMAT "%T". ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T". ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\fr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.313638548211754
Encrypted:	false
SSDEEP:	24:4azu8qW09HSZ2p60wTyVz5bGzJzzTK+VUuG4CNnvxvB:46JYY5moleiUb42vlB
MD5:	B475F8E7D7065A67E73B1E5CDBF9EB1F
SHA1:	1B689EDC29F8BC4517936E5D77A084083F12AE31
SHA-256:	7A87E418B6D8D14D8C11D63708B38D607D28F7DDBF39606C7D8FBA22BE7892CA
SHA-512:	EA77EFF9B23A02F59526499615C08F1314A91AB41561856ED7DF45930FDD8EC11A105218890FD012045C4CC40621C226F94BDC3BEB62B83EA8FAA7AEC20516E7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \. "dim."\. "lun."\. "mar."\. "mer."\. "jeu."\. "ven."\. "sam."]. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \. "dimanche"\. "lundi"\. "mardi"\. "mercredi"\. "jeudi"\. "vendredi"\. "samedi"]. ::msgcat::mcset fr MONTHS_ABBREV [list \. "janv."\. "f\u00e9vr."\. "mars"\. "avr."\. "mai"\. "juin"\. "juil."\. "ao\u00fbt"\. "sept."\. "oct."\. "nov."\. "d\u00e9c."\. ""]. ::msgcat::mcset fr MONTHS_FULL [list \. "janvier"\. "f\u00e9vrier"\. "mars"\. "avril"\. "mai"\. "juin"\. "juillet"\. "ao\u00fbt"\. "septembre"\. "octobre"\. "novembre"\. "d\u00e9cembre"\. ""]. ::msgcat::mcset fr BCE "a

C:\ProgramData\assignee\tcl\msgs\fr_be.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.863262857917797
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoXqH5oIX3vG5oIX3v6X5og+3vnFDoAov:4EnLzu81qHd3v63v6Y3v9dy
MD5:	483652B6A3D8010C3CDB6CAD0AD95E72
SHA1:	8FCDB01D0729E9F1A0CAC56F79EDB79A37734AF5
SHA-256:	980E703DFB1EEDE7DE48C958F6B501ED4251F69CB0FBCE0FCA85555F5ACF134A
SHA-512:	0282B8F3884BB4406F69AF2D2F44E431FB8077FEA86D09ED5607BC0932A049853D0C5CAF0B57EF0289F42A8265F76CC4B10111A28B1E0E9BD54E9319B25D8DB6
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset fr_BE TIME_FORMAT "%T". ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T". ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\fr_ca.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.843031408533295
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmooI9jo13vG5o13v6X5o1+3vnFDoAov:4EnLzu8eI9Q3vB3v613v9dy
MD5:	017D816D73DAB852546169F3EC2D16F2
SHA1:	3145BB54D9E1E4D9166186D5B43F411CE0250594
SHA-256:	F16E212D5D1F6E83A9FC4E56874E4C7B8F1947EE882610A73199480319EFA529
SHA-512:	4D4EF395B15F750F16EC64162BE8AB4B082C6CD1877CA63D5EA4A5E940A7F98E46D792115FD105B293DC43714E8662BC4411E14E93F09769A064622E52EDE258
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset fr_CA TIME_FORMAT "%T". ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\fr_ch.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	4.866549204705568
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoFt2poF+3vG5oF+3v6X5o++3vnFDoAov:4EnLzu8btn+3vB+3v6+3v9dy
MD5:	8B27EFF0D45F536852E7A819500B7F93
SHA1:	CAED7D4334BAD8BE586A1AEEE270FB6913A03512
SHA-256:	AB160BFDEB5C3ADF071E01C78312A81EE4223BBF5470AB880972BBF5965291F3
SHA-512:	52DD94F524C1D9AB13F5933265691E8C44B2946F507DE30D789FDCFEA7839A4076CB55A01CEB49194134D7BC84E4F490341AAB9DFB75BB960B03829D6550872B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y". ::msgcat::mcset fr_CH TIME_FORMAT "%T". ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\ga.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.24180563443443
Encrypted:	false
SSDEEP:	24:4azu8qppr5xqPs5Jpwe3zESbs5JpbxK+dfJ:46ct5XGe3zwXu4fJ
MD5:	88D5CB026EBC3605E8693D9A82C2D050
SHA1:	C2A613DC7C367A841D99DE15876F5E7A8027BBF8
SHA-256:	057C75C1AD70653733DCE43EA5BF151500F39314E8B0236EE80F8D5DB623627F
SHA-512:	253575BFB722CF06937BBE4E9867704B95EFE7B112B370E1430A2027A1818BD2560562A43AD2D067386787899093B25AE84ABFE813672A15A649FEF487E31F7A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \. "Domh"\. "Luan"\. "M\u00e1irt"\. "C\u00e9ad"\. "D\u00e9ar"\. "Aoine"\. "Sath"]. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \. "D\u00e9 Domhnaigh"\. "D\u00e9 Luain"\. "D\u00e9 M\u00e1irt"\. "D\u00e9 C\u00e9adaoin"\. "D\u00e9ardaoin"\. "D\u00e9 hAoine"\. "D\u00e9 Sathairn"]. ::msgcat::mcset ga MONTHS_ABBREV [list \. "Ean"\. "Feabh"\. "M\u00e1rta"\. "Aib"\. "Beal"\. "Meith"\. "I\u00fail"\. "L\u00fan"\. "MF\u00f3mh"\. "DF\u00f3mh"\. "Samh"\. "Noll"\. ""]. ::msgcat::mcset ga MONTHS_FULL [list \. "Ean\u00e1ir"\. "Feabhra"\. "M\u00e1rta"\. "Aibre\u00e1n"\. "M\u00ed na Bealtaine"\. "Meith"\. "I\u00fail"\. "L\u00fanasa"

C:\ProgramData\assignee\tcl\msgs\ga_ie.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.7755422576113595
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmobHAyg0obHAqo+3vG5obHAqo+3v6X5obHAy9+3vnFDoAov:4EnLzu8s33vj3v6r3v9dy
MD5:	04452D43DA05A94414973F45CDD12869
SHA1:	AEEDCC2177B592A0025A1DBCFFC0EF3634DBF562
SHA-256:	2072E48C98B480DB5677188836485B4605D5A9D99870AC73B5BFE9DCC6DB46F4
SHA-512:	5A01156FD5AB662EE9D626518B4398A161BAF934E3A618B3A18839A944AEEAEE6FE1A5279D7750511B126DB3AD2CC992CDA067573205ACBC211C34C8A099305F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y". ::msgcat::mcset ga_IE TIME_FORMAT "%T". ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T". ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\gl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.037076523160125
Encrypted:	false
SSDEEP:	24:4azu8LpP8ihyz/ptFOBViNef9kekIsnyFo0:46J0i0zRtUB0c9dkVneo0
MD5:	B940E67011DDBAD6192E9182C5F0CCC0
SHA1:	83A284899785956ECB015BBB871E7E04A7C36585
SHA-256:	C71A07169CDBE9962616D28F38C32D641DA277E53E67F8E3A69EB320C1E2B88C
SHA-512:	28570CB14452CA5285D97550EA77C9D8F71C57DE6C1D144ADB00B93712F588AF900DA32C10C3A81C7A2DEE11A3DC843780D24218F53920AB72E90321677CC9E8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Lun"\. "Mar"\. "M\u00e9r"\. "Xov"\. "Ven"\. "S\u00e1b"]. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Luns"\. "Martes"\. "M\u00e9rcores"\. "Xoves"\. "Venres"\. "S\u00e1bado"]. ::msgcat::mcset gl MONTHS_ABBREV [list \. "Xan"\. "Feb"\. "Mar"\. "Abr"\. "Mai"\. "Xu\u00f1"\. "Xul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset gl MONTHS_FULL [list \. "Xaneiro"\. "Febreiro"\. "Marzo"\. "Abril"\. "Maio"\. "Xu\u00f1o"\. "Xullo"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Decembro"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\gl_es.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.839318757139709
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoPhkgvNLoPxsF3v6aZoPhk9+3vR6HK:4EnLzu8NrvNEK3v6a2J3voq
MD5:	3FCDF0FC39C8E34F6270A646A996F663
SHA1:	6999E82148E1D1799C389BCC6C6952D5514F4A4B
SHA-256:	BC2B0424CF27BEF67F309E2B6DFFEF4D39C46F15D91C15E83E070C7FD4E20C9C
SHA-512:	CDB9ED694A7E555EB321F559E9B0CC0998FD526ADEF33AD08C56943033351D70900CD6EC62D380E23AB9F65CCFB85F4EEEB4E17FA8CC05E56C2AC57FBEDE721E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y". ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\gv.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.13549698574103
Encrypted:	false
SSDEEP:	24:4azu81WjLHkFQSMnKIeCPHy3CAVfbku5SJ:460jwyLTySI4J
MD5:	3350E1228CF7157ECE68762F967F2F32
SHA1:	2D0411DA2F6E0441B1A8683687178E9EB552B835
SHA-256:	75AA686FF901C9E66E51D36E8E78E5154B57EE9045784568F6A8798EA9689207
SHA-512:	1D0B44F00A5E6D7B8CECB67EAF060C6053045610CF7246208C8E63E7271C7780587A184D38ECFDFDCFB976F9433FEFDA0BAF8981FCD197554D0874ED1E6B6428
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \. "Jed"\. "Jel"\. "Jem"\. "Jerc"\. "Jerd"\. "Jeh"\. "Jes"]. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \. "Jedoonee"\. "Jelhein"\. "Jemayrt"\. "Jercean"\. "Jerdein"\. "Jeheiney"\. "Jesarn"]. ::msgcat::mcset gv MONTHS_ABBREV [list \. "J-guer"\. "T-arree"\. "Mayrnt"\. "Avrril"\. "Boaldyn"\. "M-souree"\. "J-souree"\. "Luanistyn"\. "M-fouyir"\. "J-fouyir"\. "M.Houney"\. "M.Nollick"\. ""]. ::msgcat::mcset gv MONTHS_FULL [list \. "Jerrey-geuree"\. "Toshiaght-arree"\. "Mayrnt"\. "Averil"\. "Boaldyn"\. "Mean-souree"\. "Jerrey-souree"\. "Luanistyn"\. "Mean-fouyir"\. "Jerrey-fouyir"\. "Mee Houney"\.

C:\ProgramData\assignee\tcl\msgs\gv_gb.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.890913756172577
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoQbtvvNLoQLE3v6aZoQbto+3vR6HK:4EnLzu8CbtvvNBLE3v6avbtF3voq
MD5:	A65040748621B18B1F88072883891280
SHA1:	4D0ED6668A99BAC9B273B0FA8BC74EB6BB9DDFC8
SHA-256:	823AF00F4E44613E929D32770EDB214132B6E210E872751624824DA5F0B78448
SHA-512:	16FFD4107C3B85619629B2CD8A48AB9BC3763FA6E4FE4AE910EDF3B42209CEEB8358D4E7E531C2417875D05E5F801BB19B10130FA8BF70E44CFD8F1BA06F6B6E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\he.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	4.234997703698801
Encrypted:	false
SSDEEP:	24:4azu8Hdd4CLxLtmCLoCLHCL3CLXLICLP1ptzLzCJCLt5LL53h5Lq+p5LcL3pLzCt:4655ftB9hMcGlhO8/n/0ecOfC3
MD5:	FFD5D8007D78770EA0E7E5643F1BD20A
SHA1:	40854EB81EE670086D0D0C0C2F0F9D8406DF6B47
SHA-256:	D27ADAF74EBB18D6964882CF931260331B93AE4B283427F9A0DB147A83DE1D55
SHA-512:	EFBDADE1157C7E1CB8458CBA89913FB44DC2399AD860FCAEDA588B99230B0934EDAAF8BAB1742E03F06FA8047D3605E8D63BB23EC4B32155C256D07C46ABBFEE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \. "\u05d0"\. "\u05d1"\. "\u05d2"\. "\u05d3"\. "\u05d4"\. "\u05d5"\. "\u05e9"]. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\. "\u05e9\u05d1\u05ea"]. ::msgcat::mcset he MONTHS_ABBREV [list \. "\u05d9\u05e0\u05d5"\. "\u05e4\u05d1\u05e8"\. "\u05de\u05e8\u05e5"\. "\u05d0\u05e4\u05e8"\. "\u05de\u05d0\u05d9"\. "\u05d9\u05d5\u05e0"\. "\u05d9\u05d5\u05dc"\. "\u05d0\u05d5\u05d2"\. "\u05e1\u05e4\u05d8"\.

C:\ProgramData\assignee\tcl\msgs\hi.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	4.1505681803025185
Encrypted:	false
SSDEEP:	24:4azu8dVYe48VcOVcz1HtDVcqiVca4mGE18VcRBkEVcRfVcRMsVcqiVca4mGE18VI:465v4bNVO7GQbBkDuM4O7GQbBkDuh3x
MD5:	349823390798DF68270E4DB46C3CA863
SHA1:	814F9506FCD8B592C22A47023E73457C469B2F53
SHA-256:	FAFE65DB09BDCB863742FDA8705BCD1C31B59E0DD8A3B347EA6DEC2596CEE0E9
SHA-512:	4D12213EA9A3EAD6828E21D3B5B73931DC922EBE8FD2373E3A3E106DF1784E0BCE2C9D1FBEAE0D433449BE6D28A0F2F50F49AB8C208E69D413C6787ADF52915E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset hi MONTHS_ABBREV [list \. "\u091c\u0928\u0935\u0930\u0940"\. "\u092b\u093c\u0930\u0935\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u0905\u092a\u094d\u0930\u0947\u0932"\. "\u092e\u0908"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u093e\u0908"\. "\u0905\u0917\u0938\u094d\u0924"\. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\. "\u0928\u0935\u092e\u094d\u092c\u093

C:\ProgramData\assignee\tcl\msgs\hi_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.882853646266983
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmocv+9/Loz3v6rZoco+3v+6f6HK:4EnLzu8+vWq3v6rpF3vmq
MD5:	BC86C58492BCB8828489B871D2A727F0
SHA1:	22EEC74FC011063071A40C3860AE8EF38D898582
SHA-256:	29C7CA358FFFCAF94753C7CC2F63B58386234B75552FA3272C2E36F253770C3F
SHA-512:	ABFE093952144A285F7A86800F5933F7242CB224D917B4BAA4FD2CA48792BEFCBEE9AB7073472510B53D31083719EC68A77DD896410B3DC3C6E2CCD60C2E92F9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\hr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	4.291836444825864
Encrypted:	false
SSDEEP:	24:4azu84VBVgqoLpYDThoLZDT25KNWg1gqNvEKvOAl:46nNYPSLZP2ZVqJTO+
MD5:	46FD3DF765F366C60B91FA0C4DE147DE
SHA1:	5E006D1ACA7BBDAC9B8A65EFB26FAFC03C6E9FDE
SHA-256:	9E14D8F7F54BE953983F198C8D59F38842C5F73419A5E81BE6460B3623E7307A
SHA-512:	3AC26C55FB514D9EA46EF57582A2E0B64822E90C889F4B83A62EE255744FEBE0A012079DD764E0F6C7338B3580421C5B6C8575E0B85632015E3689CF58D9EB77
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \. "ned"\. "pon"\. "uto"\. "sri"\. "\u010det"\. "pet"\. "sub"]. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \. "nedjelja"\. "ponedjeljak"\. "utorak"\. "srijeda"\. "\u010detvrtak"\. "petak"\. "subota"]. ::msgcat::mcset hr MONTHS_ABBREV [list \. "sij"\. "vel"\. "o\u017eu"\. "tra"\. "svi"\. "lip"\. "srp"\. "kol"\. "ruj"\. "lis"\. "stu"\. "pro"\. ""]. ::msgcat::mcset hr MONTHS_FULL [list \. "sije\u010danj"\. "velja\u010da"\. "o\u017eujak"\. "travanj"\. "svibanj"\. "lipanj"\. "srpanj"\. "kolovoz"\. "rujan"\. "listopad"\. "studeni"\. "prosinac"\. ""]. ::msgcat::mcset hr DATE_FORMAT "

C:\ProgramData\assignee\tcl\msgs\hu.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	4.447184847972284
Encrypted:	false
SSDEEP:	24:4azu8Xjv5ZemNruwcVNtZHTE9wocxPvt9vq:46fBZemNqwIZHTEE3t5q
MD5:	0561E62941F6ED8965DFC4E2B424E028
SHA1:	C622B21C0DBA83F943FBD10C746E5FABE20235B2
SHA-256:	314F4180C05DE4A4860F65AF6460900FFF77F12C08EDD728F68CA0065126B9AE
SHA-512:	CAD01C963145463612BBAE4B9F5C80B83B228C0181C2500CE8CE1394E1A32CCA3587221F1406F6343029059F5AD47E8FD5514535DCEA45BBA6B2AE76993DFFBD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \. "V"\. "H"\. "K"\. "Sze"\. "Cs"\. "P"\. "Szo"]. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \. "vas\u00e1rnap"\. "h\u00e9tf\u0151"\. "kedd"\. "szerda"\. "cs\u00fct\u00f6rt\u00f6k"\. "p\u00e9ntek"\. "szombat"]. ::msgcat::mcset hu MONTHS_ABBREV [list \. "jan."\. "febr."\. "m\u00e1rc."\. "\u00e1pr."\. "m\u00e1j."\. "j\u00fan."\. "j\u00fal."\. "aug."\. "szept."\. "okt."\. "nov."\. "dec."\. ""]. ::msgcat::mcset hu MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "m\u00e1rcius"\. "\u00e1prilis"\. "m\u00e1jus"\. "j\u00fanius"\. "j\u00falius"\. "augusztus"\. "szeptember"\. "okt\u00f3ber"\. "nove

C:\ProgramData\assignee\tcl\msgs\id.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	914
Entropy (8bit):	3.9322448438499125
Encrypted:	false
SSDEEP:	24:4azu8acGEXctI9tdb/7579g6tdhUgQbVg:46GBEXKI9tdHtdwg
MD5:	CE834C7E0C3170B733122FF8BF38C28D
SHA1:	693ACC2A0972156B984106AFD07911AF14C4F19C
SHA-256:	1F1B0F5DEDE0263BD81773A78E98AF551F36361ACCB315B618C8AE70A5FE781E
SHA-512:	23BFC6E2CDB7BA75AAC3AA75869DF4A235E4526E8E83D73551B3BC2CE89F3675EBFA75BC94177F2C2BD6AC58C1B125BE65F8489BC4F85FA701415DB9768F7A80
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \. "Min"\. "Sen"\. "Sel"\. "Rab"\. "Kam"\. "Jum"\. "Sab"]. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \. "Minggu"\. "Senin"\. "Selasa"\. "Rabu"\. "Kamis"\. "Jumat"\. "Sabtu"]. ::msgcat::mcset id MONTHS_ABBREV [list \. "Jan"\. "Peb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Agu"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset id MONTHS_FULL [list \. "Januari"\. "Pebruari"\. "Maret"\. "April"\. "Mei"\. "Juni"\. "Juli"\. "Agustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\id_id.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.857986813915644
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo0kGvNLo0F/W3v6aZo0kT+3vR6HK:4EnLzu8NGvNS3v6aQK3voq
MD5:	A285817AAABD5203706D5F2A34158C03
SHA1:	18FD0178051581C9F019604499BF91B16712CC91
SHA-256:	DB81643BA1FD115E9D547943A889A56DFC0C81B63F21B1EDC1955C6884C1B2F5
SHA-512:	0B6C684F2E5122681309A6212980C95C14172723F12D4864AF8A8A913DC7081BC42AC39CF087D29770B4A1F0B3B1F712856CBF05D1975FFFC008C16A91081A00
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y". ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\is.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.391152464169964
Encrypted:	false
SSDEEP:	24:4azu8qVXVDWpXMVmDz1ZVcWVzbQ1/xZ9b3eYXvhv3eT3:462hVW5JDz1ZVUbpfV83
MD5:	6695839F1C4D2A92552CB1647FD14DA5
SHA1:	04CB1976846A78EA9593CB3706C9D61173CE030C
SHA-256:	6767115FFF2DA05F49A28BAD78853FAC6FC716186B985474D6D30764E1727C40
SHA-512:	208766038A6A1D748F4CB2660F059AD355A5439EA6D8326F4F410B2DFBBDEECB55D4CE230C01C519B08CAB1CF5E5B3AC61E7BA86020A7BDA1AFEA624F3828521
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \. "sun."\. "m\u00e1n."\. "\u00feri."\. "mi\u00f0."\. "fim."\. "f\u00f6s."\. "lau."]. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nudagur"\. "\u00feri\u00f0judagur"\. "mi\u00f0vikudagur"\. "fimmtudagur"\. "f\u00f6studagur"\. "laugardagur"]. ::msgcat::mcset is MONTHS_ABBREV [list \. "jan."\. "feb."\. "mar."\. "apr."\. "ma\u00ed"\. "j\u00fan."\. "j\u00fal."\. "\u00e1g\u00fa."\. "sep."\. "okt."\. "n\u00f3v."\. "des."\. ""]. ::msgcat::mcset is MONTHS_FULL [list \. "jan\u00faar"\. "febr\u00faar"\. "mars"\. "apr\u00edl"\. "ma\u00ed"\. "j\u00fan\u00ed"\. "j\u00fal\u00ed"\. "\u00e1g\u00fast"\.

C:\ProgramData\assignee\tcl\msgs\it.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.207511774275323
Encrypted:	false
SSDEEP:	24:4azu8iYJcc8jYShjLhQ6I3S68gvNvlNUhsFNlVGvNmv5svc:46Wi38jBJLhQ6I3EgFtNo4NlVGlw5Kc
MD5:	8E205D032206D794A681E2A994532FA6
SHA1:	47098672D339624474E8854EB0512D54A0CA49E7
SHA-256:	C7D84001855586A0BAB236A6A5878922D9C4A2EA1799BF18544869359750C0DF
SHA-512:	139219DBD014CCA15922C45C7A0468F62E864F18CC16C7B8506258D1ECD766E1EFF6EAE4DFDAF72898B9AF1A5E6CE8D7BB0F1A93A6604D2539F2645C9ED8D146
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mer"\. "gio"\. "ven"\. "sab"]. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \. "domenica"\. "luned\u00ec"\. "marted\u00ec"\. "mercoled\u00ec"\. "gioved\u00ec"\. "venerd\u00ec"\. "sabato"]. ::msgcat::mcset it MONTHS_ABBREV [list \. "gen"\. "feb"\. "mar"\. "apr"\. "mag"\. "giu"\. "lug"\. "ago"\. "set"\. "ott"\. "nov"\. "dic"\. ""]. ::msgcat::mcset it MONTHS_FULL [list \. "gennaio"\. "febbraio"\. "marzo"\. "aprile"\. "maggio"\. "giugno"\. "luglio"\. "agosto"\. "settembre"\. "ottobre"\. "novembre"\. "dicembre"\. ""]. ::msgcat::mcset it BCE "aC". ::msgc

C:\ProgramData\assignee\tcl\msgs\it_ch.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.851375233848049
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoi5jLWNLoyJ+3vULoia+3vjLtA6:4EnLzu8m3WNJ+3v23v3t3
MD5:	8666E24230AED4DC76DB93BE1EA07FF6
SHA1:	7C688C8693C76AEE07FB32637CD58E47A85760F3
SHA-256:	2EE356FFA2491A5A60BDF7D7FEBFAC426824904738615A0C1D07AEF6BDA3B76F
SHA-512:	BCCE87FB94B28B369B9EE48D792A399DB8250D0D3D73FC05D053276A7475229EF1555D5E516D780092496F0E5F229A9912A45FB5A88C024FCEBF08E654D37B07
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y". ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S". ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\ja.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.88149888596689
Encrypted:	false
SSDEEP:	24:4azu8VcQHxbtVLKMwvtFwvQv4fTweLvDvTwS0Zu+jqgv:46RbItt4mCEebzES0njqq
MD5:	430DEB41034402906156D7E23971CD2C
SHA1:	0952FFBD241B5111714275F5CD8FB5545067FFEC
SHA-256:	38DCA9B656241884923C451A369B90A9F1D76F9029B2E98E04784323169C3251
SHA-512:	AE5DF1B79AE34DF4CC1EB00406FFF49541A95E2C732E3041CCE321F2F3FA6461BB45C6524A5FEB77E18577206CBD88A83FBF20B4B058BAE9B889179C93221557
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u6708"\. "\u706b"\. "\u6c34"\. "\u6728"\. "\u91d1"\. "\u571f"]. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \. "\u65e5\u66dc\u65e5"\. "\u6708\u66dc\u65e5"\. "\u706b\u66dc\u65e5"\. "\u6c34\u66dc\u65e5"\. "\u6728\u66dc\u65e5"\. "\u91d1\u66dc\u65e5"\. "\u571f\u66dc\u65e5"]. ::msgcat::mcset ja MONTHS_FULL [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"]. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d". ::msgcat::mcset ja CE "\u897f\u66a6". ::msgcat::mcset ja AM "\u5348\u524d". ::msgcat::mcset ja PM "\u5348\u5f8c". ::msgcat::mcset ja DATE_FORMAT "%Y/%m/%

C:\ProgramData\assignee\tcl\msgs\kl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.013253613061898
Encrypted:	false
SSDEEP:	24:4azu83jGeo9sbjCjS3jCwjLj+zSsS9CfzTA2Qcl:46OOsJzTvl
MD5:	AE55E001BBE3272CE13369C836139EF3
SHA1:	D912A0AEBA08BC97D80E9B7A55CE146956C90BCC
SHA-256:	1B00229DF5A979A040339BBC72D448F39968FEE5CC24F07241C9F6129A9B53DD
SHA-512:	E53E8DB56AD367E832A121D637CA4755E6C8768C063E4BE43E6193C5F71ED7AA10F7223AC85750C0CAD543CF4A0BFE578CBA2877F176A5E58DCA2BAA2F7177FB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \. "sab"\. "ata"\. "mar"\. "pin"\. "sis"\. "tal"\. "arf"]. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \. "sabaat"\. "ataasinngorneq"\. "marlunngorneq"\. "pingasunngorneq"\. "sisamanngorneq"\. "tallimanngorneq"\. "arfininngorneq"]. ::msgcat::mcset kl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset kl MONTHS_FULL [list \. "januari"\. "februari"\. "martsi"\. "aprili"\. "maji"\. "juni"\. "juli"\. "augustusi"\. "septemberi"\. "oktoberi"\. "novemberi"\. "decemberi"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\kl_gl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.83493357349932
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEpb53FD/LoEpLE3vG5oEpLE3v6X5oEpba+3vnFDoAov:4EnLzu8KF3FD/1w3vMw3v6T/3v9dy
MD5:	4B8E5B6EB7C27A02DBC0C766479B068D
SHA1:	E97A948FFE6C8DE99F91987155DF0A81A630950E
SHA-256:	F99DA45138A8AEBFD92747FC28992F0C315C6C4AD97710EAF9427263BFFA139C
SHA-512:	D726494A6F4E1FB8C71B8B56E9B735C1837D8D22828D006EF386E41AD15CD1E4CF14DAC01966B9AFE41F7B6A44916EFC730CF038B4EC393043AE9021D11DACF2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y". ::msgcat::mcset kl_GL TIME_FORMAT "%T". ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T". ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\ko.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	4.552910804130986
Encrypted:	false
SSDEEP:	24:4azu8cVBfHVnYgY+YGkYeY02Y7YkMXjDHMXjqKKyvtuvFd8vUPvwEq:46ojlmpYEY7XjDsXj+0t4zaU3wt
MD5:	A4C37AF81FC4AA6003226A95539546C1
SHA1:	A18A7361783896C691BD5BE8B3A1FCCCCB015F43
SHA-256:	F6E2B0D116D2C9AC90DDA430B6892371D87A4ECFB6955318978ED6F6E9D546A6
SHA-512:	FBE6BA258C250BD90FADCC42AC18A17CC4E7B040F160B94075AF1F42ECD43EEA6FE49DA52CF9B5BBB5D965D6AB7C4CC4053A78E865241F891E13F94EB20F0472
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \. "\uc77c"\. "\uc6d4"\. "\ud654"\. "\uc218"\. "\ubaa9"\. "\uae08"\. "\ud1a0"]. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \. "\uc77c\uc694\uc77c"\. "\uc6d4\uc694\uc77c"\. "\ud654\uc694\uc77c"\. "\uc218\uc694\uc77c"\. "\ubaa9\uc694\uc77c"\. "\uae08\uc694\uc77c"\. "\ud1a0\uc694\uc77c"]. ::msgcat::mcset ko MONTHS_ABBREV [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\. "9\uc6d4"\. "10\uc6d4"\. "11\uc6d4"\. "12\uc6d4"\. ""]. ::msgcat::mcset ko MONTHS_FULL [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\.

C:\ProgramData\assignee\tcl\msgs\ko_kr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.015790750376121
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo56SFZhjNo56m5Ybo56TGMZo56a/W3v6mfvLo56TT+3vOAEP:4EnLzu8r62vjs6m5YS6TGN6a+3v6o66J
MD5:	9C7E97A55A957AB1D1B5E988AA514724
SHA1:	592F8FF9FABBC7BF48539AF748DCFC9241AED82D
SHA-256:	31A4B74F51C584354907251C55FE5CE894D2C9618156A1DC6F5A979BC350DB17
SHA-512:	9D04DF2A87AFE24C339E1A0F6358FE995CBCAF8C7B08A1A7953675E2C2C1EDBCAF297B23C2B9BEC398DFEE6D1D75CE32E31389A7199466A38BC83C8DBBA67C77
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804". ::msgcat::mcset ko_KR CE "\uc11c\uae30". ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d". ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S". ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\kok.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1958
Entropy (8bit):	4.1451019501109965
Encrypted:	false
SSDEEP:	24:4azu8Z448VcOVczWdSVcqVcR0q4vTqBBiXCVcqVcR0q4vTqBBiaMv:46u48h0qpBBaR0qpBBVu
MD5:	E7938CB3AF53D42B4142CB104AB04B3B
SHA1:	6205BD2336857F368CABF89647F54D94E093A77B
SHA-256:	D236D5B27184B1E813E686D901418117F22D67024E6944018FC4B633DF9FF744
SHA-512:	CE77CE2EC773F3A1A3CD68589C26F7089E8133ADE601CE899EEB0B13648051344A94E69AEC2C8C58349456E52B11EB7545C8926E3F08DB643EE551C641FF38DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset kok MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0

C:\ProgramData\assignee\tcl\msgs\kok_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.8580653411441155
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo5VsNv+9/Lo5VsU3v6rZo5VsNo+3v+6f6HK:4EnLzu8rVsNvWiVsU3v6rAVsNF3vmq
MD5:	A3B27D44ED430AEC7DF2A47C19659CC4
SHA1:	700E4B9C395B540BFCE9ABDC81E6B9B758893DC9
SHA-256:	BEE07F14C7F4FC93B62AC318F89D2ED0DD6FF30D2BF21C2874654FF0292A6C4B
SHA-512:	79E9D8B817BDB6594A7C95991B2F6D7571D1C2976E74520D28223CF9F05EAA2128A44BC83A94089F09011FFCA9DB5E2D4DD74B59DE2BADC022E1571C595FE36C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\kw.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	966
Entropy (8bit):	3.9734955453120504
Encrypted:	false
SSDEEP:	12:4EnLzu8z4md0eKwCW44mtls79cp32AqghoPx9ab43gWgw3SeWOdSyECYf5AQZ0eD:4azu806vCmgs7aB2seFkhq+9
MD5:	413A264B40EEBEB28605481A3405D27D
SHA1:	9C2EFA6326C62962DCD83BA8D16D89616D2C5B77
SHA-256:	F49F4E1C7142BF7A82FC2B9FC075171AE45903FE69131478C15219D72BBAAD33
SHA-512:	CF0559DB130B8070FEC93A64F5317A2C9CDE7D5EAFD1E92E76EAAE0740C6429B7AB7A60BD833CCA4ABCC0AADEBC6A68F854FF654E0707091023D275404172427
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \. "Sul"\. "Lun"\. "Mth"\. "Mhr"\. "Yow"\. "Gwe"\. "Sad"]. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \. "De Sul"\. "De Lun"\. "De Merth"\. "De Merher"\. "De Yow"\. "De Gwener"\. "De Sadorn"]. ::msgcat::mcset kw MONTHS_ABBREV [list \. "Gen"\. "Whe"\. "Mer"\. "Ebr"\. "Me"\. "Evn"\. "Gor"\. "Est"\. "Gwn"\. "Hed"\. "Du"\. "Kev"\. ""]. ::msgcat::mcset kw MONTHS_FULL [list \. "Mys Genver"\. "Mys Whevrel"\. "Mys Merth"\. "Mys Ebrel"\. "Mys Me"\. "Mys Evan"\. "Mys Gortheren"\. "Mye Est"\. "Mys Gwyngala"\. "Mys Hedra"\. "Mys Du"\. "Mys Kevardhu"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\kw_gb.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.914818138642697
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoh6AvvNLoh633v6aZoh6Ao+3vR6HK:4EnLzu8z6AvvN6633v6aY6AF3voq
MD5:	D325ADCF1F81F40D7B5D9754AE0542F3
SHA1:	7A6BCD6BE5F41F84B600DF355CB00ECB9B4AE8C0
SHA-256:	7A8A539C8B990AEFFEA06188B98DC437FD2A6E89FF66483EF334994E73FD0EC9
SHA-512:	A05BBB3F80784B9C8BBA3FE618FEE154EE40D240ED4CFF7CD6EEE3D97BC4F065EFF585583123F1FFD8ABA1A194EB353229E15ED5CD43759D4D356EC5BE8DCD73
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\lt.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.4416408590245
Encrypted:	false
SSDEEP:	24:4azu8FHYI4/+HYZoNPW43VvJZb3lSuRnixx/x5JfbiMQeTVYkG2CvRksvQ:46hHNHhu43VxZb3lSuRwxZ5VbiMQeTVL
MD5:	73F0A9C360A90CB75C6DA7EF87EF512F
SHA1:	582EB224C9715C8336B4D1FCE7DDEC0D89F5AD71
SHA-256:	510D8EED3040B50AFAF6A3C85BC98847F1B4D5D8A685C5EC06ACC2491B890101
SHA-512:	B5482C7448BFC44B05FCF7EB0642B0C7393F4438082A507A94C13F56F12A115A5CE7F0744518BB0B2FAF759D1AD7744B0BEDB98F563C2A4AB11BC4619D7CEA22
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \. "Sk"\. "Pr"\. "An"\. "Tr"\. "Kt"\. "Pn"\. "\u0160t"]. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \. "Sekmadienis"\. "Pirmadienis"\. "Antradienis"\. "Tre\u010diadienis"\. "Ketvirtadienis"\. "Penktadienis"\. "\u0160e\u0161tadienis"]. ::msgcat::mcset lt MONTHS_ABBREV [list \. "Sau"\. "Vas"\. "Kov"\. "Bal"\. "Geg"\. "Bir"\. "Lie"\. "Rgp"\. "Rgs"\. "Spa"\. "Lap"\. "Grd"\. ""]. ::msgcat::mcset lt MONTHS_FULL [list \. "Sausio"\. "Vasario"\. "Kovo"\. "Baland\u017eio"\. "Gegu\u017e\u0117s"\. "Bir\u017eelio"\. "Liepos"\. "Rugpj\u016b\u010dio"\. "Rugs\u0117jo"\. "Spalio"\. "Lapkri\u010dio"\. "G

C:\ProgramData\assignee\tcl\msgs\lv.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.39393801727056
Encrypted:	false
SSDEEP:	24:4azu8lmZG0me3AEcGo49bJcpF9gT9PCbF5uld0vVcASAr8svJ5vk3:46TGAE8Q/PG5dv//Lk3
MD5:	D5DEB8EFFE6298858F9D1B9FAD0EA525
SHA1:	973DF40D0464BCE10EB5991806D9990B65AB0F82
SHA-256:	FD95B38A3BEBD59468BDC2890BAC59DF31C352E17F2E77C82471E1CA89469802
SHA-512:	F024E3D6D30E8E5C3316364A905C8CCAC87427BFC2EC10E72065F1DD114A112A61FDECDF1C4EC9C3D8BB9A54D18ED4AE9D57B07DA4AFFE480DE12F3D54BED928
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \. "Sv"\. "P"\. "O"\. "T"\. "C"\. "Pk"\. "S"]. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \. "sv\u0113tdiena"\. "pirmdiena"\. "otrdiena"\. "tre\u0161diena"\. "ceturdien"\. "piektdiena"\. "sestdiena"]. ::msgcat::mcset lv MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maijs"\. "J\u016bn"\. "J\u016bl"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset lv MONTHS_FULL [list \. "janv\u0101ris"\. "febru\u0101ris"\. "marts"\. "apr\u012blis"\. "maijs"\. "j\u016bnijs"\. "j\u016blijs"\. "augusts"\. "septembris"\. "oktobris"\. "novembris"\. "decembris"\. ""]. ::msgcat

C:\ProgramData\assignee\tcl\msgs\mk.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.237536682442766
Encrypted:	false
SSDEEP:	48:46UcQdZnlcQfAQPWQEHKr9nGUeDjDpxpWQ1Q3QuQoQLX9TSQ2QIQPQHp7+8i:hNdR7cr9nMvXI0i7F89TSn1KX
MD5:	CD589758D4F4B522781A10003D3E1791
SHA1:	D953DD123D54B02BAF4B1AE0D36081CDFCA38444
SHA-256:	F384DD88523147CEF42AA871D323FC4CBEE338FF67CC5C95AEC7940C0E531AE3
SHA-512:	2EA1E71CD1E958F83277006343E85513D112CBB3C22CBFF29910CB1FC37F2389B3F1DCB2533EC59F9E642624869E5C61F289FDC010B55C6EECEF378F2D92DB0B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0435\u0434."\. "\u043f\u043e\u043d."\. "\u0432\u0442."\. "\u0441\u0440\u0435."\. "\u0447\u0435\u0442."\. "\u043f\u0435\u0442."\. "\u0441\u0430\u0431."]. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0435\u043b\u0430"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\. "\u043f\u0435\u0442\u043e\u043a"\. "\u0441\u0430\u0431\u043e\u0442\u0430"]. ::msgcat::mcset mk MONTHS_ABBREV [list \. "\u0458\u0430\u043d."\. "\u0444\u0435\u0432."\. "\u043c\u0430\u0440."\. "\u0430\u043f\u0440."\. "\u043c\u0430\u0458."\. "\u0458\u0443\u043d."\. "\u0458\

C:\ProgramData\assignee\tcl\msgs\mr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.160320823510059
Encrypted:	false
SSDEEP:	24:4azu8ocYe48VcOVczyVczoRSVcqVcR0q4vTqBBiPNVcqVcR0q4vTqBBil:46R48h0qpBBkI0qpBBe
MD5:	791408BAE710B77A27AD664EC3325E1C
SHA1:	E760B143A854838E18FFB66500F4D312DD80634E
SHA-256:	EB2E2B7A41854AF68CEF5881CF1FBF4D38E70D2FAB2C3F3CE5901AA5CC56FC15
SHA-512:	FE91EF67AB9313909FE0C29D5FBE2298EE35969A26A63D94A406BFDA7BCF932F2211F94C0E3C1D718DBC2D1145283C768C23487EEB253249ACFE76E8D1F1D1E5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset mr MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0930"\.

C:\ProgramData\assignee\tcl\msgs\mr_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.847742455062573
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoGNv+9/LoGU3v6rZoGNo+3v+6f6HK:4EnLzu8GvWe3v6r5F3vmq
MD5:	899E845D33CAAFB6AD3B1F24B3F92843
SHA1:	FC17A6742BF87E81BBD4D5CB7B4DCED0D4DD657B
SHA-256:	F75A29BB323DB4354B0C759CB1C8C5A4FFC376DFFD74274CA60A36994816A75C
SHA-512:	99D05FCE8A9C9BE06FDA8B54D4DE5497141F6373F470B2AB24C2D00B9C56031350F5DCDA2283A0E6F5B09FF21218FC3C7E2A6AB8ECC5BB020546FD62BDC8FF99
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\ms.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	910
Entropy (8bit):	3.9292866027924838
Encrypted:	false
SSDEEP:	12:4EnLzu82mCBuvFYcEfmt1qWjefjESRsToOqrlHvFguSixTRs1OAfC67:4azu82nBuHEfKxjeby7cl9gbZUAfCc
MD5:	441CC737D383D8213F64B62A5DBEEC3E
SHA1:	34FBE99FB25A0DCA2FDA2C008AC8127BA2BC273B
SHA-256:	831F611EE851A64BF1BA5F9A5441EC1D50722FA9F15B4227707FE1927F754DE4
SHA-512:	0474B2127890F63814CD9E77D156B5E4FC45EB3C17A57719B672AC9E3A6EEA9934F0BE158F76808B34A11DA844AB900652C18E512830278DFED2666CD005FBE5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \. "Aha"\. "Isn"\. "Sei"\. "Rab"\. "Kha"\. "Jum"\. "Sab"]. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \. "Ahad"\. "Isnin"\. "Selasa"\. "Rahu"\. "Khamis"\. "Jumaat"\. "Sabtu"]. ::msgcat::mcset ms MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mac"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ogos"\. "Sep"\. "Okt"\. "Nov"\. "Dis"\. ""]. ::msgcat::mcset ms MONTHS_FULL [list \. "Januari"\. "Februari"\. "Mac"\. "April"\. "Mei"\. "Jun"\. "Julai"\. "Ogos"\. "September"\. "Oktober"\. "November"\. "Disember"\. ""].}.

C:\ProgramData\assignee\tcl\msgs\ms_my.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.770028367699931
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoChFflD/LoChF+3v6xH5oCh++3vflm6PYv:4EnLzu8IPflD/ne3v6Tl3vflm6q
MD5:	8261689A45FB754158B10B044BDC4965
SHA1:	6FFC9B16A0600D9BC457322F1316BC175309C6CA
SHA-256:	D05948D75C06669ADDB9708BC5FB48E6B651D4E62EF1B327EF8A3F605FD5271C
SHA-512:	0321A5C17B3E33FDE9480AC6014B373D1663219D0069388920D277AA61341B8293883517C900030177FF82D65340E6C9E3ED051B27708DD093055E3BE64B2AF3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.

C:\ProgramData\assignee\tcl\msgs\mt.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	690
Entropy (8bit):	4.48913642143724
Encrypted:	false
SSDEEP:	12:4EnLzu8+YmWjjRgWfjxBTo4erxy1IGZzNN+3v6amK3vZsq:4azu8+YZjjRXbfNedy1IG5N6vjmsvGq
MD5:	CE7E67A03ED8C3297C6A5B634B55D144
SHA1:	3DA5ACC0F52518541810E7F2FE57751955E12BDA
SHA-256:	D115718818E3E3367847CE35BB5FF0361D08993D9749D438C918F8EB87AD8814
SHA-512:	3754AA7B7D27A813C6113D2AA834A951FED1B81E4DACE22C81E0583F29BBC73C014697F39A2067DEC622D98EACD70D26FD40F80CF6D09E1C949F01FADED52C74
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \. "\u0126ad"\. "Tne"\. "Tli"\. "Erb"\. "\u0126am"\. "\u0120im"]. ::msgcat::mcset mt MONTHS_ABBREV [list \. "Jan"\. "Fra"\. "Mar"\. "Apr"\. "Mej"\. "\u0120un"\. "Lul"\. "Awi"\. "Set"\. "Ott"\. "Nov"]. ::msgcat::mcset mt BCE "QK". ::msgcat::mcset mt CE "". ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y". ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\nb.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	4.24006506188001
Encrypted:	false
SSDEEP:	24:4azu8CKEj4/xasSpfiTBtHQT1V/W3WNfvZv3l:46KU/0s2iTeVOiHN1
MD5:	D5509ABF5CBFB485C20A26FCC6B1783E
SHA1:	53A298FBBF09AE2E223B041786443A3D8688C9EB
SHA-256:	BC401889DD934C49D10D99B471441BE2B536B1722739C7B0AB7DE7629680F602
SHA-512:	BDAFBA46EF44151CFD9EF7BC1909210F6DB2BAC20C31ED21AE3BE7EAC785CD4F545C4590CF551C0D066F982E2050F5844BDDC569F32C5804DBDE657F4511A6FE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset nb MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nb MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nb BCE "f.Kr.". ::msgcat::mcset nb CE "e.Kr.".

C:\ProgramData\assignee\tcl\msgs\nl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.158523842311663
Encrypted:	false
SSDEEP:	24:4azu84LFiS8LMKZoNfSZTNTQhFCNZvtWvg:46Oi5LMKZASZTEF2Ntgg
MD5:	98820DFF7E1C8A9EAB8C74B0B25DEB5D
SHA1:	5357063D5699188E544D244EC4AEFDDF7606B922
SHA-256:	49128B36B88E380188059C4B593C317382F32E29D1ADC18D58D14D142459A2BB
SHA-512:	26AB945B7BA00433BEC85ACC1D90D1D3B70CE505976CABE1D75A7134E00CD591AC27463987C515EEA079969DBCF200DA9C8538CAAF178A1EE17C9B0284260C45
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \. "zo"\. "ma"\. "di"\. "wo"\. "do"\. "vr"\. "za"]. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \. "zondag"\. "maandag"\. "dinsdag"\. "woensdag"\. "donderdag"\. "vrijdag"\. "zaterdag"]. ::msgcat::mcset nl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mrt"\. "apr"\. "mei"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset nl MONTHS_FULL [list \. "januari"\. "februari"\. "maart"\. "april"\. "mei"\. "juni"\. "juli"\. "augustus"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset nl DATE_FORMAT "%e %B %Y". ::msgcat::mcset nl TIME_FORM

C:\ProgramData\assignee\tcl\msgs\nl_be.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.817188474504631
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo4gPI5og9X3vG5og9X3v6X5o49+3vnFDoAov:4EnLzu8WgAhF3v8F3v6JI3v9dy
MD5:	B08E30850CA849068D06A99B4E216892
SHA1:	11B5E95FF4D822E76A1B9C28EEC2BC5E95E5E362
SHA-256:	9CD54EC24CBDBEC5E4FE543DDA8CA95390678D432D33201FA1C32B61F8FE225A
SHA-512:	9AF147C2F22B11115E32E0BFD0126FE7668328E7C67B349A781F42B0022A334E53DDF3FCCC2C34C91BFBB45602A002D0D7B569B5E1FE9F0EE6C4570400CB0B0C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y". ::msgcat::mcset nl_BE TIME_FORMAT "%T". ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T". ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\nn.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.207752506572597
Encrypted:	false
SSDEEP:	24:4azu8eNsP2/xhsSpf2TBtHQT15j63WN7v9v3l:46it/vs22Te5OiL51
MD5:	2266607EF358B632696C7164E61358B5
SHA1:	A380863A8320DAB1D5A2D60C22ED5F7DB5C7BAF7
SHA-256:	5EE93A8C245722DEB64B68EFF50C081F24DA5DE43D999C006A10C484E1D3B4ED
SHA-512:	2A8DEF754A25736D14B958D8B0CEA0DC41C402A9EFA25C9500BA861A7E8D74C79939C1969AC694245605C17D33AD3984F6B9ACCA4BE03EFC41A878772BB5FD86
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \. "su"\. "m\u00e5"\. "ty"\. "on"\. "to"\. "fr"\. "lau"]. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \. "sundag"\. "m\u00e5ndag"\. "tysdag"\. "onsdag"\. "torsdag"\. "fredag"\. "laurdag"]. ::msgcat::mcset nn MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nn MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nn BCE "f.Kr.". ::msgcat::mcset nn CE "e.Kr.". ::msgca

C:\ProgramData\assignee\tcl\msgs\pl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1211
Entropy (8bit):	4.392723231340452
Encrypted:	false
SSDEEP:	12:4EnLzu854moKR4mtPoTckd8EnO6z3K4jwxI1LRhtm3ni8FwxIBgdE4RsMZmB0CLs:4azu8yNgyJxPEyRhonO+AjTg0Okvpvn
MD5:	31A9133E9DCA7751B4C3451D60CCFFA0
SHA1:	FB97A5830965716E77563BE6B7EB1C6A0EA6BF40
SHA-256:	C39595DDC0095EB4AE9E66DB02EE175B31AC3DA1F649EB88FA61B911F838F753
SHA-512:	329EE7FE79783C83361A0C5FFFD7766B64B8544D1AD63C57AEAA2CC6A526E01D9C4D7765C73E88F86DAE57477459EA330A0C42F39E441B50DE9B0F429D01EAE8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \. "N"\. "Pn"\. "Wt"\. "\u015ar"\. "Cz"\. "Pt"\. "So"]. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \. "niedziela"\. "poniedzia\u0142ek"\. "wtorek"\. "\u015broda"\. "czwartek"\. "pi\u0105tek"\. "sobota"]. ::msgcat::mcset pl MONTHS_ABBREV [list \. "sty"\. "lut"\. "mar"\. "kwi"\. "maj"\. "cze"\. "lip"\. "sie"\. "wrz"\. "pa\u017a"\. "lis"\. "gru"\. ""]. ::msgcat::mcset pl MONTHS_FULL [list \. "stycze\u0144"\. "luty"\. "marzec"\. "kwiecie\u0144"\. "maj"\. "czerwiec"\. "lipiec"\. "sierpie\u0144"\. "wrzesie\u0144"\. "pa\u017adziernik"\. "listopad"\. "grudzie\u0144"\. ""]. ::msgcat::m

C:\ProgramData\assignee\tcl\msgs\pt.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.325163993882846
Encrypted:	false
SSDEEP:	24:4azu8pYpzzktTYyUgC0CIKjblie5f9kwAAs+CFsFoD6GADvtU6svO:46dCzWTh2AA9/2F4oD6GAztU6KO
MD5:	D827F76D1ED6CB89839CAC2B56FD7252
SHA1:	140D6BC1F6CEF5FD0A390B3842053BF54B54B4E2
SHA-256:	9F2BFFA3B4D8783B2CFB2CED9CC4319ACF06988F61829A1E5291D55B19854E88
SHA-512:	B662336699E23E371F0148EDD742F71874A7A28DFA81F0AFAE91C8C9494CEA1904FEA0C21264CF2A253E0FB1360AD35B28CFC4B74E4D7B2DBB0E453E96F7EB93
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Seg"\. "Ter"\. "Qua"\. "Qui"\. "Sex"\. "S\u00e1b"]. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Segunda-feira"\. "Ter\u00e7a-feira"\. "Quarta-feira"\. "Quinta-feira"\. "Sexta-feira"\. "S\u00e1bado"]. ::msgcat::mcset pt MONTHS_ABBREV [list \. "Jan"\. "Fev"\. "Mar"\. "Abr"\. "Mai"\. "Jun"\. "Jul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset pt MONTHS_FULL [list \. "Janeiro"\. "Fevereiro"\. "Mar\u00e7o"\. "Abril"\. "Maio"\. "Junho"\. "Julho"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Dezembro"\. ""]. ::msgcat::mcset pt DATE_FO

C:\ProgramData\assignee\tcl\msgs\pt_br.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.8127929329126085
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmofm6GPWHFLofAW3vG5ofAW3v6X5ofm6T+3vnFDoAov:4EnLzu8hNGgF493vr93v6uNK3v9dy
MD5:	4EE34960147173A12020A583340E92F8
SHA1:	78D91A80E2426A84BC88EE97DA28EC0E4BE8DE45
SHA-256:	E383B20484EE90C00054D52DD5AF473B2AC9DC50C14D459A579EF5F44271D256
SHA-512:	EDFF8FB9A86731FFF005AFBBBB522F69B2C6033F59ECCD5E35A8B6A9E0F9AF23C52FFDCC22D893915AD1854E8104C81DA8C5BD8C794C7E645AFB82001B4BFC24
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset pt_BR TIME_FORMAT "%T". ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T". ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\ProgramData\assignee\tcl\msgs\ro.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	4.279005910896047
Encrypted:	false
SSDEEP:	24:4azu8/0oFUBZNk1Mkp3pFukZEoVYfPcF+T1vWFMvUvWI3:46kNkKkpLEoSfPcFgvWFqSWI3
MD5:	0F5C8A7022DB1203442241ABEB5901FF
SHA1:	C54C8BF05E8E6C2C0901D3C88C89DDCF35A26924
SHA-256:	D2E14BE188350D343927D5380EB5672039FE9A37E9A9957921B40E4619B36027
SHA-512:	13ACF499FA803D4446D8EC67119BC8257B1F093084B83D854643CEA918049F96C8FA08DC5F896EECA80A5FD552D90E5079937B1A3894D89A589E468172856163
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \. "D"\. "L"\. "Ma"\. "Mi"\. "J"\. "V"\. "S"]. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \. "duminic\u0103"\. "luni"\. "mar\u0163i"\. "miercuri"\. "joi"\. "vineri"\. "s\u00eemb\u0103t\u0103"]. ::msgcat::mcset ro MONTHS_ABBREV [list \. "Ian"\. "Feb"\. "Mar"\. "Apr"\. "Mai"\. "Iun"\. "Iul"\. "Aug"\. "Sep"\. "Oct"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset ro MONTHS_FULL [list \. "ianuarie"\. "februarie"\. "martie"\. "aprilie"\. "mai"\. "iunie"\. "iulie"\. "august"\. "septembrie"\. "octombrie"\. "noiembrie"\. "decembrie"\. ""]. ::msgcat::mcset ro BCE "d.C.". ::msgcat::mcset ro CE

C:\ProgramData\assignee\tcl\msgs\ru.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	4.225775794669275
Encrypted:	false
SSDEEP:	48:46CpQ7kvicQfAQPlQoBBCZAitBmZ/QhQoQaQPTeQgQonQ4FQEWFkt3Wd:hCpgkvzRo6QBw53weFHXFgIGd
MD5:	3A7181CE08259FF19D2C27CF8C6752B3
SHA1:	97DFFB1E224CEDB5427841C3B59F85376CD4423B
SHA-256:	C2A3A0BE5BC5A46A6A63C4DE34E317B402BAD40C22FB2936E1A4F53C1E2F625F
SHA-512:	CC9620BA4601E53B22CCFC66A0B53C26224158379DF6BA2D4704A2FE11222DFBDAE3CA9CF51576B4084B8CCA8DB13FDE81396E38F94BCD0C8EA21C5D77680394
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \. "\u0412\u0441"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"]. ::msgcat::mcset ru MONTHS_ABBREV [list \. "\u044f\u043d\u0432"\. "\u0444\u0435\u0432"\. "\u043c\u0430\u0440"\. "\u0430\u043f\u0440"\. "\u043c\u0430\u0439"\. "\u0438\u044e\u043d"\. "\u0438\u

C:\ProgramData\assignee\tcl\msgs\ru_ua.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.8961185447535
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoVAgWFLoVY9X3vtfNrFLoVA9+3vW6Q9:4EnLzu8DFWFgaX3vtNS/3vWH9
MD5:	E719F47462123A8E7DABADD2D362B4D8
SHA1:	332E4CC96E7A01DA7FB399EA14770A5C5185B9F2
SHA-256:	AE5D3DF23F019455F3EDFC3262AAC2B00098881F09B9A934C0D26C0AB896700C
SHA-512:	93C19D51B633A118AB0D172C5A0991E5084BD54B2E61469D800F80B251A57BD1392BA66FD627586E75B1B075A7C9C2C667654F5783C423819FBDEA640A210BFA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y". ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S". ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\sh.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.287536872407747
Encrypted:	false
SSDEEP:	24:4azu8YYy/FY+Cnwj4EbJK5O9g+tQhgQmy/L6GWGvtlMsvWT9:46al4ETw/rWQtVWh
MD5:	C7BBD44BD3C30C6116A15C77B15F8E79
SHA1:	37CD1477A3318838E8D5C93D596A23F99C8409F2
SHA-256:	00F119701C9F3EBA273701A6A731ADAFD7B8902F6BCCF34E61308984456E193A
SHA-512:	DAFBDA53CF6AD57A4F6A078E9EF8ED3CACF2F8809DC2AEFB812A4C3ACCD51D954C52079FA26828D670BF696E14989D3FE3C249F1E612B7C759770378919D8BBC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Uto"\. "Sre"\. "\u010cet"\. "Pet"\. "Sub"]. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljak"\. "Utorak"\. "Sreda"\. "\u010cetvrtak"\. "Petak"\. "Subota"]. ::msgcat::mcset sh MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maj"\. "Jun"\. "Jul"\. "Avg"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset sh MONTHS_FULL [list \. "Januar"\. "Februar"\. "Mart"\. "April"\. "Maj"\. "Juni"\. "Juli"\. "Avgust"\. "Septembar"\. "Oktobar"\. "Novembar"\. "Decembar"\. ""]. ::msgcat::mcset sh BCE "p. n. e.". ::msgcat::mcset sh CE "n. e."

C:\ProgramData\assignee\tcl\msgs\sk.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1203
Entropy (8bit):	4.335103779497533
Encrypted:	false
SSDEEP:	24:4azu834j4PV3sSAT3fk3TEJbAT3T1cPyF3eYuCvte/v3eG:46TUG3sPk3TEkcPyFpuEtenJ
MD5:	B2EF88014D274C8001B36739F5F566CE
SHA1:	1044145C1714FD44D008B13A31BC778DFBE47950
SHA-256:	043DECE6EA7C83956B3300B95F8A0E92BADAA8FC29D6C510706649D1D810679A
SHA-512:	820EB42D94BEE21FDB990FC27F7900CF676AFC59520F3EE78FB72D6D7243A17A234D4AE964E5D52AD7CBC7DD9A593F672BAD8A80EC48B25B344AA6950EF52ECF
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "Ut"\. "St"\. "\u0160t"\. "Pa"\. "So"]. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \. "Nede\u013ee"\. "Pondelok"\. "Utorok"\. "Streda"\. "\u0160tvrtok"\. "Piatok"\. "Sobota"]. ::msgcat::mcset sk MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sk MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "marec"\. "apr\u00edl"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "august"\. "september"\. "okt\u00f3ber"\. "november"\. "december"\. ""]. ::msgcat::mcset sk BCE

C:\ProgramData\assignee\tcl\msgs\sl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.26110325084843
Encrypted:	false
SSDEEP:	24:4azu8PyUpd4+RfscasS9CErTByism1KSCvt1vJo6:462U/ENsqrTtVEtRx
MD5:	2566BDE28B17C526227634F1B4FC7047
SHA1:	BE6940EC9F4C5E228F043F9D46A42234A02F4A03
SHA-256:	BD488C9D791ABEDF698B66B768E2BF24251FFEAF06F53FB3746CAB457710FF77
SHA-512:	CC684BFC82CA55240C5B542F3F63E0FF43AEF958469B3978E414261BC4FADB50A0AE3554CF2468AC88E4DDB70D2258296C0A2FBB69312223EED56C7C03FEC17C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Tor"\. "Sre"\. "\u010cet"\. "Pet"\. "Sob"]. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljek"\. "Torek"\. "Sreda"\. "\u010cetrtek"\. "Petek"\. "Sobota"]. ::msgcat::mcset sl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "avg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sl MONTHS_FULL [list \. "januar"\. "februar"\. "marec"\. "april"\. "maj"\. "junij"\. "julij"\. "avgust"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sl BCE "pr.n.\u0161.". ::msgcat::mcset sl CE "p

C:\ProgramData\assignee\tcl\msgs\sq.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	4.339253133089184
Encrypted:	false
SSDEEP:	24:4azu82qJw7W5wO6jwbNU7FtHhoJCLov4v2:46iWrvGtBo6+O2
MD5:	931A009F7E8A376972DE22AD5670EC88
SHA1:	44AEF01F568250851099BAA8A536FBBACD3DEBBB
SHA-256:	CB27007E138315B064576C17931280CFE6E6929EFC3DAFD7171713D204CFC3BF
SHA-512:	47B230271CD362990C581CD6C06B0BCEA23E10E03D927C7C28415739DB3541D69D1B87DF554E9B4F00ECCAAB0F6AC0565F9EB0DEA8B75C54A90B2D53C928D379
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \. "Die"\. "H\u00ebn"\. "Mar"\. "M\u00ebr"\. "Enj"\. "Pre"\. "Sht"]. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \. "e diel"\. "e h\u00ebn\u00eb"\. "e mart\u00eb"\. "e m\u00ebrkur\u00eb"\. "e enjte"\. "e premte"\. "e shtun\u00eb"]. ::msgcat::mcset sq MONTHS_ABBREV [list \. "Jan"\. "Shk"\. "Mar"\. "Pri"\. "Maj"\. "Qer"\. "Kor"\. "Gsh"\. "Sht"\. "Tet"\. "N\u00ebn"\. "Dhj"\. ""]. ::msgcat::mcset sq MONTHS_FULL [list \. "janar"\. "shkurt"\. "mars"\. "prill"\. "maj"\. "qershor"\. "korrik"\. "gusht"\. "shtator"\. "tetor"\. "n\u00ebntor"\. "dhjetor"\. ""]. ::msgcat::mcset sq BCE "p.e.

C:\ProgramData\assignee\tcl\msgs\sr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	4.24530896413441
Encrypted:	false
SSDEEP:	48:46qoQCSdQqQP4QSsIVKP10NupiuQxQaQLlKnM28nGtfR:hjIX15VKP6NmBU3YKnFbp
MD5:	5CA16D93718AAA813ADE746440CF5CE6
SHA1:	A142733052B87CA510B8945256399CE9F873794C
SHA-256:	313E8CDBBC0288AED922B9927A7331D0FAA2E451D4174B1F5B76C5C9FAEC8F9B
SHA-512:	4D031F9BA75D45EC89B2C74A870CCDA41587650D7F9BC91395F68B70BA3CD7A7105E70C19D139D20096533E06F5787C00EA850E27C4ADCF5A28572480D39B639
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0435\u0434"\. "\u041f\u043e\u043d"\. "\u0423\u0442\u043e"\. "\u0421\u0440\u0435"\. "\u0427\u0435\u0442"\. "\u041f\u0435\u0442"\. "\u0421\u0443\u0431"]. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u0459\u0430"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\. "\u0423\u0442\u043e\u0440\u0430\u043a"\. "\u0421\u0440\u0435\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\. "\u041f\u0435\u0442\u0430\u043a"\. "\u0421\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset sr MONTHS_ABBREV [list \. "\u0408\u0430\u043d"\. "\u0424\u0435\u0431"\. "\u041c\u0430\u0440"\. "\u0410\u043f\u0440"\. "\u041c\u0430\u0458"\. "\u0408\u0443\u043d"\. "\u0408\u0443\u043b"\.

C:\ProgramData\assignee\tcl\msgs\sv.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	4.2825791311526515
Encrypted:	false
SSDEEP:	24:4azu8JLmAQVm/xTsS9CfxTlijQkcjKxFvivn:46hVQc/psJxT8kyhkn
MD5:	496D9183E2907199056CA236438498E1
SHA1:	D9C3BB4AEBD9BFD942593694E796A8C2FB9217B8
SHA-256:	4F32E1518BE3270F4DB80136FAC0031C385DD3CE133FAA534F141CF459C6113A
SHA-512:	FA7FDEDDC42C36D0A60688CDBFE9A2060FE6B2644458D1EBFC817F1E5D5879EB3E3C78B5E53E9D3F42E2E4D84C93C4A7377170986A437EFF404F310D1D72F135
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \. "s\u00f6"\. "m\u00e5"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f6"]. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \. "s\u00f6ndag"\. "m\u00e5ndag"\. "tisdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f6rdag"]. ::msgcat::mcset sv MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sv MONTHS_FULL [list \. "januari"\. "februari"\. "mars"\. "april"\. "maj"\. "juni"\. "juli"\. "augusti"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sv BCE "f.Kr.". ::msgcat::mcset sv C

C:\ProgramData\assignee\tcl\msgs\sw.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	991
Entropy (8bit):	4.024338627988864
Encrypted:	false
SSDEEP:	12:4EnLzu8r4mc4Go/4mtVfqRvodJ3fjESBToOqe3lHvFgdF6A3ixTZ6OM5mSYoC6Vy:4azu88kGDiq1qhbJ75V9gZSpgmSm9
MD5:	4DB24BA796D86ADF0441D2E75DE0C07E
SHA1:	9935B36FF2B1C6DFDE3EC375BC471A0E93D1F7E3
SHA-256:	6B5AB8AE265DB436B15D32263A8870EC55C7C0C07415B3F9BAAC37F73BC704E5
SHA-512:	BE7ED0559A73D01537A1E51941ED19F0FEC3F14F9527715CB119E89C97BD31CC6102934B0349D8D0554F5EDD9E3A02978F7DE4919C000A77BD353F7033A4A95B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \. "Jpi"\. "Jtt"\. "Jnn"\. "Jtn"\. "Alh"\. "Iju"\. "Jmo"]. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \. "Jumapili"\. "Jumatatu"\. "Jumanne"\. "Jumatano"\. "Alhamisi"\. "Ijumaa"\. "Jumamosi"]. ::msgcat::mcset sw MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ago"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset sw MONTHS_FULL [list \. "Januari"\. "Februari"\. "Machi"\. "Aprili"\. "Mei"\. "Juni"\. "Julai"\. "Agosti"\. "Septemba"\. "Oktoba"\. "Novemba"\. "Desemba"\. ""]. ::msgcat::mcset sw BCE "KK". ::msgcat::mcset sw CE "BK".}.

C:\ProgramData\assignee\tcl\msgs\ta.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1835
Entropy (8bit):	4.018233695396
Encrypted:	false
SSDEEP:	24:4azu83w0xn8dnzhmmlmYgtg+CKf6CO5ztFSLt8tCtGtv+CKf6CO5ztFSLt8tCtNu:46k0dgmmlmYgtE/t1H
MD5:	2D9C969318D1740049D28EBBD4F62C1D
SHA1:	121665081AFC33DDBCF679D7479BF0BC47FEF716
SHA-256:	30A142A48E57F194ECC3AA9243930F3E6E1B4E8B331A8CDD2705EC9C280DCCBB
SHA-512:	7C32907C39BFB89F558692535041B2A7FA18A64E072F5CF9AB95273F3AC5A7C480B4F953B13484A07AA4DA822613E27E78CC7B02ACE7A61E58FDB5507D7579C3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\. "\u0b9a\u0ba9\u0bbf"]. ::msgcat::mcset ta MONTHS_ABBREV [list \. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\. "\u0bae\u0bc7"\. "\u0b9c\u0bc2\u0ba9\u0bcd"\. "\u0b9c\u0bc2\u0bb2\u0bc8"\. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\. "\u0ba8\u0bb

C:\ProgramData\assignee\tcl\msgs\ta_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.815592015875268
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmosDv+9/LosK3v6rZosDo+3v+6f6HK:4EnLzu8eDvWbK3v6r5DF3vmq
MD5:	293456B39BE945C55536A5DD894787F0
SHA1:	94DEF0056C7E3082E58266BCE436A61C045EA394
SHA-256:	AA57D5FB5CC3F59EC6A3F99D7A5184403809AA3A3BC02ED0842507D4218B683D
SHA-512:	AB763F2932F2FF48AC18C8715F661F7405607E1818B53E0D0F32184ABE67714F03A39A9D0637D0D93CE43606C3E1D702D2A3F8660C288F61DFE852747B652B59
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\te.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	4.034298184367717
Encrypted:	false
SSDEEP:	48:46x9mcib30Rgu1je5YdnULEP8l1je5YdnULEPt:hnIb39ufbufV
MD5:	0B9B124076C52A503A906059F7446077
SHA1:	F43A0F6CCBDDBDD5EA140C7FA55E9A82AB910A03
SHA-256:	42C34D02A6079C4D0D683750B3809F345637BC6D814652C3FB0B344B66B70C79
SHA-512:	234B9ACA1823D1D6B82583727B4EA68C014D59916B410CB9B158FA1954B6FC3767A261BD0B9F592AF0663906ADF11C2C9A3CC0A325CB1FF58F42A884AF7CB015
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \. "\u0c06\u0c26\u0c3f"\. "\u0c38\u0c4b\u0c2e"\. "\u0c2e\u0c02\u0c17\u0c33"\. "\u0c2c\u0c41\u0c27"\. "\u0c17\u0c41\u0c30\u0c41"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\. "\u0c36\u0c28\u0c3f"]. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"]. ::msgcat::mcset te MONTHS_ABBREV [list \. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\. "\u0c2e\u0c3e\u0c30\u0c4d\u0c1a\u

C:\ProgramData\assignee\tcl\msgs\te_in.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.01781242466238
Encrypted:	false
SSDEEP:	12:4EnLzu8CjZWsn0sEjoD0sLvUFS3v6r5F3vMq:4azu84Z1nnEjoDnLvUFEvS5NvMq
MD5:	443E34E2E2BC7CB64A8BA52D99D6B4B6
SHA1:	D323C03747FE68E9B73F7E5C1E10B168A40F2A2F
SHA-256:	88BDAF4B25B684B0320A2E11D3FE77DDDD25E3B17141BD7ED1D63698C480E4BA
SHA-512:	5D8B267530EC1480BF3D571AABC2DA7B4101EACD7FB03B49049709E39D665DD7ACB66FD785BA2B5203DDC54C520434219D2D9974A1E9EE74C659FFAEA6B694E0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\ProgramData\assignee\tcl\msgs\th.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2305
Entropy (8bit):	4.324407451316591
Encrypted:	false
SSDEEP:	48:46P4QX/wQT0H/u3rPc8JD57XWWND8QM70xJi53Ljtef:hQ556rVDWZcLOO
MD5:	D145F9DF0E339A2538662BD752F02E16
SHA1:	AFD97F8E8CC14D306DEDD78F8F395738E38A8569
SHA-256:	F9641A6EBE3845CE5D36CED473749F5909C90C52E405F074A6DA817EF6F39867
SHA-512:	E17925057560462F730CF8288856E46FA1F1D2A10B5D4D343257B7687A3855014D5C65B6C85AC55A7C77B8B355DB19F053C74B91DFA7BE7E9F933D9D4DA117F7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \. "\u0e2d\u0e32."\. "\u0e08."\. "\u0e2d."\. "\u0e1e."\. "\u0e1e\u0e24."\. "\u0e28."\. "\u0e2a."]. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"]. ::msgcat::mcset th MONTHS_ABBREV [list \. "\u0e21.\u0e04."\. "\u0e01.\u0e1e."\. "\u0e21\u0e35.\u0e04."\. "\u0e40\u0e21.\u0e22."\. "\u0e1e.\u0e04."\. "\u0e21\u0e34.\u0e22."\. "\

C:\ProgramData\assignee\tcl\msgs\tr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.32041719596907
Encrypted:	false
SSDEEP:	24:4azu80VAFVsNTib5vk5CfYTnGk65GmogWFLNvoKvWI3:46j8NTgwVTnlSJWFLJvWI3
MD5:	3AFAD9AD82A9C8B754E2FE8FC0094BAB
SHA1:	4EE3E2DF86612DB314F8D3E7214D7BE241AA1A32
SHA-256:	DF7C4BA67457CB47EEF0F5CA8E028FF466ACDD877A487697DC48ECAC7347AC47
SHA-512:	79A6738A97B7DB9CA4AE9A3BA1C3E56BE9AC67E71AE12154FD37A37D78892B6414A49E10E007DE2EB314942DC017B87FAB7C64B74EC9B889DAEBFF9B3B78E644
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \. "Paz"\. "Pzt"\. "Sal"\. "\u00c7ar"\. "Per"\. "Cum"\. "Cmt"]. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \. "Pazar"\. "Pazartesi"\. "Sal\u0131"\. "\u00c7ar\u015famba"\. "Per\u015fembe"\. "Cuma"\. "Cumartesi"]. ::msgcat::mcset tr MONTHS_ABBREV [list \. "Oca"\. "\u015eub"\. "Mar"\. "Nis"\. "May"\. "Haz"\. "Tem"\. "A\u011fu"\. "Eyl"\. "Eki"\. "Kas"\. "Ara"\. ""]. ::msgcat::mcset tr MONTHS_FULL [list \. "Ocak"\. "\u015eubat"\. "Mart"\. "Nisan"\. "May\u0131s"\. "Haziran"\. "Temmuz"\. "A\u011fustos"\. "Eyl\u00fcl"\. "Ekim"\. "Kas\u0131m"\. "Aral\u0131k"\. ""]. ::msgcat::mcset tr D

C:\ProgramData\assignee\tcl\msgs\uk.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	4.227105489438195
Encrypted:	false
SSDEEP:	48:46+ytFoQAQPHUKPo6eQ4QBuQ0WbQcJeyFQDWZlQD1QbS7XQn1Q7mDaSAJQ7GMLzM:hIpP5tzYhTUhAgEAE+
MD5:	458A38F894B296C83F85A53A92FF8520
SHA1:	CE26187875E334C712FDAB73E6B526247C6FE1CF
SHA-256:	CF2E78EF3322F0121E958098EF5F92DA008344657A73439EAC658CB6BF3D72BD
SHA-512:	3B8730C331CF29EF9DEDBC9D5A53C50D429931B8DA01EE0C20DAE25B995114966DB9BC576BE0696DEC088DB1D88B50DE2C376275AB5251F49F6544E546BBC531
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0432\u0442"\. "\u0441\u0440"\. "\u0447\u0442"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0456\u043b\u044f"\. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\. "\u0441\u0435\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440"\. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset uk MONTHS_ABBREV [list \. "\u0441\u0456\u0447"\. "\u043b\u044e\u0442"\. "\u0431\u0435\u0440"\. "\u043a\u0432\u0456\u0442"\. "\u0442\u0440\u0430\u0432"\. "\u0447\u0435\u0440\u0432"\. "\u043b\u0438\u043f"\. "\

C:\ProgramData\assignee\tcl\msgs\vi.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	4.382223858419589
Encrypted:	false
SSDEEP:	24:4azu8pNu9UT5xDHy2W82yGWnf/oxHFBSWWS1D/avSv16:46Oixzy2IyhwZ17cU16
MD5:	3BD0AB95976D1B80A30547E4B23FD595
SHA1:	B3E5DC095973E46D8808326B2A1FC45046B5267F
SHA-256:	9C69094C0BD52D5AE8448431574EAE8EE4BE31EC2E8602366DF6C6BF4BC89A58
SHA-512:	2A68A7ADC385EDEA02E4558884A24DCC6328CC9F7D459CC03CC9F2D2F58CF6FF2103AD5B45C6D05B7E13F28408C6B05CDDF1DF60E822E5095F86A49052E19E59
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \. "Th 2"\. "Th 3"\. "Th 4"\. "Th 5"\. "Th 6"\. "Th 7"\. "CN"]. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \. "Th\u01b0\u0301 hai"\. "Th\u01b0\u0301 ba"\. "Th\u01b0\u0301 t\u01b0"\. "Th\u01b0\u0301 n\u0103m"\. "Th\u01b0\u0301 s\u00e1u"\. "Th\u01b0\u0301 ba\u0309y"\. "Chu\u0309 nh\u00e2\u0323t"]. ::msgcat::mcset vi MONTHS_ABBREV [list \. "Thg 1"\. "Thg 2"\. "Thg 3"\. "Thg 4"\. "Thg 5"\. "Thg 6"\. "Thg 7"\. "Thg 8"\. "Thg 9"\. "Thg 10"\. "Thg 11"\. "Thg 12"\. ""]. ::msgcat::mcset vi MONTHS_FULL [list \. "Th\u00e1ng m\u00f4\u0323t"\. "Th\u00e1ng hai"\. "Th\u00e1ng ba"\. "Th\u00e1ng t\u01b0"\. "Th\u00e1ng n\u0103m"\. "Th\u00e1ng s\

C:\ProgramData\assignee\tcl\msgs\zh.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text, with very long lines (1598)
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	4.469203967086526
Encrypted:	false
SSDEEP:	48:468jDI/Tw71xDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyzag29dL:hn7wRdNL
MD5:	9C33FFDD4C13D2357AB595EC3BA70F04
SHA1:	A87F20F7A331DEFC33496ECDA50D855C8396E040
SHA-256:	EF81B41EC69F67A394ECE2B3983B67B3D0C8813624C2BFA1D8A8C15B21608AC9
SHA-512:	E31EEE90660236BCD958F3C540F56B2583290BAD6086AE78198A0819A92CF2394C62DE3800FDDD466A8068F4CABDFBCA46A648D419B1D0103381BF428D721B13
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh MONTHS_ABBREV [list \. "\u4e00\u6708"\. "\u4e8c\u6708"\. "\u4e09\u6708"\. "\u56db\u6708"\. "\u4e94\u6708"\. "\u516d\u6708"\. "\u4e03\u6708"\. "\u516b\u6708"\. "\u4e5d\u6708"\. "\u5341\u6708"\. "\u5341\u4e00\u6708"\. "\u5341\u4e8c\u6708"\. ""]. ::msgcat::mcset zh MONTHS_FULL [list \.

C:\ProgramData\assignee\tcl\msgs\zh_cn.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.1281364096481665
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoX5HoHJ+3vtfNrFLoHJ+3v6MY+oXa+3vYq9:4EnLzu8d5eJ+3vtNEJ+3v6L1L3vYq9
MD5:	EB94B41551EAAFFA5DF4F406C7ACA3A4
SHA1:	B0553108BDE43AA7ED362E2BFFAF1ABCA1567491
SHA-256:	85F91CF6E316774AA5D0C1ECA85C88E591FD537165BB79929C5E6A1CA99E56C8
SHA-512:	A0980A6F1AD9236647E4F18CC104999DB2C523153E8716FD0CFE57320E906DF80378A5C0CDE132F2C53F160F5304EAF34910D7D1BB5753987D74AFBC0B6F75F3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e". ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S". ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2". ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\zh_hk.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	752
Entropy (8bit):	4.660158381384211
Encrypted:	false
SSDEEP:	12:4EnLzu8qmDBHZLX+TyW4OU5yPgM9Lz+SC3WwLNMW3v6G3v3Ww+:4azu8qyFOw3WwLrvTv3Ww+
MD5:	D8C6BFBFCE44B6A8A038BA44CB3DB550
SHA1:	FBD609576E65B56EDA67FD8A1801A27B43DB5486
SHA-256:	D123E0B4C2614F680808B58CCA0C140BA187494B2C8BCF8C604C7EB739C70882
SHA-512:	3455145CF5C77FC847909AB1A283452D0C877158616C8AA7BDFFC141B86B2E66F9FF45C3BB6A4A9D758D2F8FFCB1FE919477C4553EFE527C0EDC912EBBCAABCD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u4e00"\. "\u4e8c"\. "\u4e09"\. "\u56db"\. "\u4e94"\. "\u516d"]. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"\. ""]. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5". ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S". ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\zh_sg.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.020358587042703
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoOpxoPpSocvNLohX3v6ZhLoh+3v6fJ:4EnLzu8WvNo3v6b3vu
MD5:	E0BC93B8F050D6D80B8173FF4FA4D7B7
SHA1:	231FF1B6F859D0261F15D2422DF09E756CE50CCB
SHA-256:	2683517766AF9DA0D87B7A862DE9ADEA82D9A1454FC773A9E3C1A6D92ABA947A
SHA-512:	8BA6EAC5F71167B83A58B47123ACF7939C348FE2A0CA2F092FE9F60C0CCFB901ADA0E8F2101C282C39BAE86C918390985731A8F66E481F8074732C37CD50727F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_SG AM "\u4e0a\u5348". ::msgcat::mcset zh_SG PM "\u4e2d\u5348". ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y". ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z".}.

C:\ProgramData\assignee\tcl\msgs\zh_tw.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.08314435797197
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoAykaRULH/XRxvBoAyjZRULH5oAyU/G0OZoAyxW3v6ZhLoAR:4EnLzu8I5xEOKRWW3v6w3v8AC
MD5:	9CD17E7F28186E0E71932CC241D1CBB1
SHA1:	AF1EE536AABB8198BA88D3474ED49F76A37E89FF
SHA-256:	D582406C51A3DB1EADF6507C50A1F85740FDA7DA8E27FC1438FEB6242900CB12
SHA-512:	4712DD6A27A09EA339615FC3D17BC8E4CD64FF12B2B8012E01FD4D3E7789263899FA05EDDB77044DC7B7D32B3DC55A52B8320D93499DF9A6799A8E4D07174525
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d". ::msgcat::mcset zh_TW CE "\u6c11\u570b". ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e". ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z".}.

C:\ProgramData\assignee\tcl\opt0.4\optparse.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	32720
Entropy (8bit):	4.541357106605742
Encrypted:	false
SSDEEP:	768:UczgW5gzrui4sKDt3+7sGbHMmjJbuQH8A2Q:VgTrrvd7sGbHDFSQH8/Q
MD5:	1E4933F698FFE2B82D8BB5146C08ECA0
SHA1:	F580AD7B46092C02340EC6D634117AA2817C0666
SHA-256:	EBD5D5B5DBD9798CD43CEAD2843FB222D3BBDED4ED4792528BEAB876E61B83C6
SHA-512:	80F325AAF5F48FBC8897865EEF9873EA3D6FFEFAD27774D364F2DBF0F98813B16DB478A80497E4B1673FBD1273E76C94C923B06C91F3DA207A44272CE74284E2
Malicious:	false
Preview:	# optparse.tcl --.#.# (private) Option parsing package.# Primarily used internally by the safe:: code..#.#.WARNING: This code will go away in a future release.#.of Tcl. It is NOT supported and you should not rely.#.on it. If your code does rely on this package you.#.may directly incorporate this code into your application...package require Tcl 8.2.# When this version number changes, update the pkgIndex.tcl file.# and the install directory in the Makefiles..package provide opt 0.4.6..namespace eval ::tcl {.. # Exported APIs. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \. OptProc OptProcArgGiven OptParse \.. Lempty Lget \. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \. SetMax SetMin...################# Example of use / 'user documentation' ###################.. proc OptCreateTestProc {} {...# Defines ::tcl::OptParseTest as a test proc with parsed arguments..# (can't be defined before the code below is

C:\ProgramData\assignee\tcl\opt0.4\pkgIndex.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.652658850873767
Encrypted:	false
SSDEEP:	12:jHxJRuMopS42wyGlTajUA43KXks4L1GbyvX6VxQ+pBbX:bvRmS42wyGlTah9XkbL7X6VxBB
MD5:	92FF1E42CFC5FECCE95068FC38D995B3
SHA1:	B2E71842F14D5422A9093115D52F19BCCA1BF881
SHA-256:	EB9925A8F0FCC7C2A1113968AB0537180E10C9187B139C8371ADF821C7B56718
SHA-512:	608D436395D055C5449A53208F3869B8793DF267B8476AD31BCDD9659A222797814832720C495D938E34BF7D253FFC3F01A73CC0399C0DFB9C85D2789C7F11C0
Malicious:	false
Preview:	# Tcl package index file, version 1.1.# This file is generated by the "pkg_mkIndex -direct" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...if {![package vsatisfies [package provide Tcl] 8.2]} {return}.package ifneeded opt 0.4.6 [list source [file join $dir optparse.tcl]].

C:\ProgramData\assignee\tcl\package.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22964
Entropy (8bit):	4.836148909536567
Encrypted:	false
SSDEEP:	384:I72oQXm9jcLyBLWueSzvAXMiow90l3NhETrh4NLTluYhoNL3ZAqYx:I72oQXmgyBCqvAcFw2dhOrh4NZVhoN30
MD5:	C04C438C6E7C9DB959CDF952074484CE
SHA1:	D14FFC498EC76C1FE3D923403003206FC9894ED5
SHA-256:	34654F5851EC90FEF41721F0636975E5801C1BDCAF8D14CDCAD50904D335E509
SHA-512:	9E8806BE87428CA1A5948232DCD4B6426FF1719379BC03BC2F3B10447B6688F31DF7777241D691DDF2CA95393D9940AD0E3D001849FCDD9CB946F0023582D339
Malicious:	false
Preview:	# package.tcl --.#.# utility procs formerly in init.tcl which can be loaded on demand.# for package management..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval tcl::Pkg {}..# ::tcl::Pkg::CompareExtension --.#.# Used internally by pkg_mkIndex to compare the extension of a file to a given.# extension. On Windows, it uses a case-insensitive comparison because the.# file system can be file insensitive..#.# Arguments:.# fileName.name of a file whose extension is compared.# ext..(optional) The extension to compare against; you must.#..provide the starting dot..#..Defaults to [info sharedlibextension].#.# Results:.# Returns 1 if the extension matches, 0 otherwise..proc tcl::Pkg::CompareExtension {fileName {ext {}}} {. global tcl_platform. if {$ext eq ""} {set ext

C:\ProgramData\assignee\tcl\parray.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	803
Entropy (8bit):	4.832763542213876
Encrypted:	false
SSDEEP:	12:TcS2n1RBbgZKaNHaeYFSxYmXqt9306UafZwXgEImK7k35IpbdELS8/McjbPgnE:TcHn5sZKGkwa/1xfJmRGNc93j7CE
MD5:	727E547C9C9A8A2B0937FB1C20E8AA26
SHA1:	46A08300C8D8176D7458394CFC14C22057513EEC
SHA-256:	CCDEE375379162A69C43ECF76068150475108C01DD5886915C8355B5FA78E006
SHA-512:	4E0CEFE7F484CFFAD5C89CBE0288D0BD83875BCD7388C135177C496DD5143CEF5C7B576944B82CD305832E1AC813AB81623FDC02FAF9527F31C5DEF655FD3FC5
Malicious:	false
Preview:	# parray:.# Print the contents of a global array on stdout..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..proc parray {a {pattern }} {. upvar 1 $a array. if {![array exists array]} {..error "\"$a\" isn't an array". }. set maxl 0. set names [lsort [array names array $pattern]]. foreach name $names {..if {[string length $name] > $maxl} {.. set maxl [string length $name]..}. }. set maxl [expr {$maxl + [string length $a] + 2}]. foreach name $names {..set nameString [format %s(%s) $a $name]..puts stdout [format "%-s = %s" $maxl $nameString $array($name)]. }.}.

C:\ProgramData\assignee\tcl\safe.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	33447
Entropy (8bit):	4.750011933692196
Encrypted:	false
SSDEEP:	768:OovFcXxzYqZ1//L2J4lb77BvnthiV0EnoQI4MXNhGQmzY3wKIYkA:OovFcqqZF2J4lb7Rrg0EnoQI44NhGrzu
MD5:	2875486B7223BE666E40C1655D9CBA35
SHA1:	445AFD28C7E9E9F418BCA9AC416C8886183D39E4
SHA-256:	8AE253BCC49073806349C18386A6A329AD1101CF6C1580C57534D936F1E0804D
SHA-512:	7CA5D0E24682CF9017E19683D53A4AA2FC061779602A572AB3458F36B6CBF3DC0B228A522EF421FF941F5949C6FA29989B937A2254763DC1C75E4F335B000B2F
Malicious:	false
Preview:	# safe.tcl --.#.# This file provide a safe loading/sourcing mechanism for safe interpreters..# It implements a virtual path mecanism to hide the real pathnames from the.# slave. It runs in a master interpreter and sets up data structure and.# aliases that will be invoked when used from a slave interpreter..#.# See the safe.n man page for details..#.# Copyright (c) 1996-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.# The implementation is based on namespaces. These naming conventions are.# followed:.# Private procs starts with uppercase..# Public procs are exported and starts with lowercase.#..# Needed utilities package.package require opt 0.4.1..# Create the safe namespace.namespace eval ::safe {. # Exported API:. namespace export interpCreate interpInit interpConfigure interpDelete \..interpAddToAccessPath interpFindInAccessPath setLogCmd.}..# Helper function to

C:\ProgramData\assignee\tcl\tclIndex

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5415
Entropy (8bit):	4.701682771925196
Encrypted:	false
SSDEEP:	96:esataNULULUVUhU5U1UIUZUJeUpgURUFD15Q0AkU6PkrBkGUjZKspDzmK5SMFTub:eNtEACkiwM3g4ePOiD15Q0AkU6PkrBko
MD5:	E127196E9174B429CC09C040158F6AAB
SHA1:	FF850F5D1BD8EFC1A8CB765FE8221330F0C6C699
SHA-256:	ABF7D9D1E86DE931096C21820BFA4FD70DB1F55005D2DB4AA674D86200867806
SHA-512:	C4B98EBC65E25DF41E6B9A93E16E608CF309FA0AE712578EE4974D84F7F33BCF2A6ED7626E88A343350E13DA0C5C1A88E24A87FCBD44F7DA5983BB3EF036A162
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0.# -- tcl --.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(auto_reset) [list source [file join $dir auto.tcl]].set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.tcl]].set auto_in

C:\ProgramData\assignee\tcl\tm.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11626
Entropy (8bit):	4.700251804022156
Encrypted:	false
SSDEEP:	192:CnjVD6gOGFpvXKPrzYkWo55z3ovPvKvaWZPZ9W6TV9ujpZw7K3mQEuPltqQvu9:CGQvX+XYkn59YvPSvDJTV9174CuPltBC
MD5:	03C19D0E1648AE030BEEC16B897C31F6
SHA1:	DFB0699CB4520E4704EF625854EC11CEEAE764D5
SHA-256:	8247559E6C5AA3AD02716F3F3431FAC713DE563467F249901C854877953B8EB9
SHA-512:	8109D80183999008B04A227D8DC7C9D14F9CD1A5A17EE222AAD45C9F07E6C3DB7B95493624D3F3B604133926B8DF11844E33AB72E9686371373A44AF9F3EA6E3
Malicious:	false
Preview:	# -- tcl --.#.# Searching for Tcl Modules. Defines a procedure, declares it as the primary.# command for finding packages, however also uses the former 'package unknown'.# command as a fallback..#.# Locates all possible packages in a directory via a less restricted glob. The.# targeted directory is derived from the name of the requested package, i.e..# the TM scan will look only at directories which can contain the requested.# package. It will register all packages it found in the directory so that.# future requests have a higher chance of being fulfilled by the ifneeded.# database without having to come to us again..#.# We do not remember where we have been and simply rescan targeted directories.# when invoked again. The reasoning is this:.#.# - The only way we get back to the same directory is if someone is trying to.# [package require] something that wasn't there on the first scan..#.# Either.# 1) It is there now: If we rescan, you get it; if not you don't..#.# This co

C:\ProgramData\assignee\tcl\tzdata\Africa\Abidjan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.951583909886815
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcsG/kXGm2OHnFvpsYvUdSalHFLd:SlSWB9X52DBGTm2OHnFvmYValHf
MD5:	6FB79707FD3A183F8A3C780CA2669D27
SHA1:	E703AB552B4231827ACD7872364C36C70988E4C0
SHA-256:	A5DC7BFB4F569361D438C8CF13A146CC2641A1A884ACF905BB51DA28FF29A900
SHA-512:	CDD3AD9AFFD246F4DFC40C1699E368FB2924E73928060B1178D298DCDB11DBD0E88BC10ED2FED265F7F7271AC5CCE14A60D65205084E9249154B8D54C2309E52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Abidjan) {. {-9223372036854775808 -968 0 LMT}. {-1830383032 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Accra

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.306430974601464
Encrypted:	false
SSDEEP:	6:SlSWB9X52DU2Lm2OHp5aIXscJAQnU42SQYQ4KHOxDklwr:MBp52DUsmdHvjpU4C4Yugk
MD5:	B6820345F7C90DF00D388FAC2D7D8615
SHA1:	4CA4DB7C817C53AB6F4A4FF219FC6FFB1E64FB00
SHA-256:	C4C580E7EEB27B5BCA2E750A404B7190112C3985F0901845F4D079B86907B7CF
SHA-512:	BF67D2FD934D3F63E9862D628F4EEB807AA9DE421F67AEAA44DF493E5F020B6E76406FA6CCFB103FEF3E4BF2272DE84F99E6FBBBF182FA9E6AF1A785378FC2A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Accra) {. {-9223372036854775808 -52 0 LMT}. {-1640995148 0 0 GMT}. {-1051920000 1200 1 GHST}. {-1041466800 0 0 GMT}. {-1020384000 1200 1 GHST}. {-1009930800 0 0 GMT}. {-988848000 1200 1 GHST}. {-978394800 0 0 GMT}. {-957312000 1200 1 GHST}. {-946858800 0 0 GMT}. {-925689600 1200 1 GHST}. {-915236400 0 0 GMT}. {-894153600 1200 1 GHST}. {-883700400 0 0 GMT}. {-862617600 1200 1 GHST}. {-852164400 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Addis_Ababa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.888875108360427
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DczqIUXGm2OHq1FGxYvWUQKXdfFnXFw/sV42FFslv:SlSWB9X52Dnom2OHGkxY7QcpFwKu
MD5:	274A8CD7620D885D6A1783A046649F58
SHA1:	072F54CB87FFF2F08E3B6C1AD52F0951BEB2C84F
SHA-256:	5A8153DB35B8C3F9B305CB5DE0CC07F4599F118DD9EF8409609FC734348F072F
SHA-512:	26F4B9CB8D0A1E3EE918D43A6EB8870E2EC3C4111B997961ED66F1BB53652483BF5317AF1C5B70CB2BA4B9981B2350184E79570C3F58F7A7ED76AB4C0011DEBD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Addis_Ababa) {. {-9223372036854775808 9288 0 LMT}. {-3155682888 9320 0 ADMT}. {-1062210920 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Algiers

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	4.110061823095588
Encrypted:	false
SSDEEP:	12:MBp52D7AmdHh5PMybVSqSFvvqXFaLSaSxmvWo/fmvCkQ6eW6Xs8QQB1r5Q:cQIefMyb8BF6XFaLSxktf1PW6X4q1K
MD5:	8221A83520B1D3DE02E886CFB1948DE3
SHA1:	0806A0898FDE6F5AE502C64515A1345D71B1F7D2
SHA-256:	5EE3B25676E813D89ED866D03B5C3388567D8307A2A60D1C4A34D938CBADF710
SHA-512:	2B8A837F7CF6DE43DF4072BF4A54226235DA8B8CA78EF55649C7BF133B2E002C614FE7C693004E3B17C25FBCECAAD5CD9B0A8CB0A5D32ADF68EA019203EE8704
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Algiers) {. {-9223372036854775808 732 0 LMT}. {-2486679072 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1531443600 0 0 WET}. {-956365200 3600 1 WEST}. {-950486400 0 0 WET}. {-942012000 3600 0 CET}. {-812502000 7200 1 CEST}. {-796262400 3600 0 CET}. {-781052400 7200 1 CEST}. {-766630800 3600 0 CET}. {-733280400 0 0 WET}. {-439430400 3600 0 CET}. {-212029200 0 0 WET}. {41468400 3600 1 WEST}. {54774000 0 0 WET}. {231724800 3600 1 WEST}. {246240000 3600 0 CET}. {259545600 7200 1 CEST}. {275274000 3600 0 CET}. {309740400 0 0 WET}. {325468800 3600 1 WEST}. {3418020

C:\ProgramData\assignee\tcl\tzdata\Africa\Asmara

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.778693788222811
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcjEUEwcXGm2OHAkevWUQKXcTFV3xGZTWVVw/sV42FFslv:SlSWB9X52DGbm2OHJe7QDvGZabwKu
MD5:	FB0618C4C2F3C0EED77674D71F3E5A6D
SHA1:	F29C8DD4AEDE55AB8B5EFB61184A504AE599D965
SHA-256:	E9C1710744E66DC559A9D4AB0BCD180C813411D2BE6458A6E99183B2734BB4D2
SHA-512:	6B22D8AE43DE881D8C30B1AF4EE33B3E8C1ADF0E2BF7B0B69C5B047A4E3211B6F1C788CB5A17E6DC1331FD0180E2AC519C0CAE19F849CCED888AEF0CCA07732B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Asmara) {. {-9223372036854775808 9332 0 LMT}. {-3155682932 9332 0 AMT}. {-2524530932 9320 0 ADMT}. {-1062210920 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Asmera

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.718682713064743
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsjEUGkdVAIgNGEXEUKN2DcjAWDcjEUu:SlSWB9IZaM3y7PtdVAIgNTrKN2D8DGu
MD5:	694B2849DFA4017184061711CB651DC5
SHA1:	A393458E21DD49669D6B6AB7A8B45D4BF697423A
SHA-256:	DC469FBF3D658DCACAA1738F9CB8A3820A01EE494D8637896F6781D58C29C8C1
SHA-512:	04B96F7AC8C51AA46CAFFA8D5311FAB29EECF3635C688DB97E128B961AEFD7C301221B1A904936AB402F95144CB48A00BC83B2BC2D2B6D9A8996BF2B53B387E5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Asmara)]} {. LoadTimeZoneFile Africa/Asmara.}.set TZData(:Africa/Asmera) $TZData(:Africa/Asmara).

C:\ProgramData\assignee\tcl\tzdata\Africa\Bamako

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.7766834167426335
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcxfEXGm2OHE55vUdSaVF7lUT3VQWTvYvFYVUFNFd:SlSWB9X52DwfLm2OHkVaVAVvGdv
MD5:	982DDE520A2E65AC97F23042AA13FB7C
SHA1:	4D0138E2564A10F087FF857322197A4077829602
SHA-256:	2BFDB9FC1025D1EF6E3F59B885C8ECB7C122B3C6C4655EB21793B45B56F58081
SHA-512:	104FEB900BF899EE6D314B54E21B4EF3189B1EE22ACC24F4559EA814DD08172C7E2D15F97DDD933C2A1A16324B8FCD839A9C64D1CA8C04B4FFCDEEA4E048E02D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bamako) {. {-9223372036854775808 -1920 0 LMT}. {-1830382080 0 0 GMT}. {-1131235200 -3600 0 WAT}. {-300841200 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Bangui

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.981520266784117
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dcx2RFSXGm2OH3TvVkevUdSaMVFZYvCn:SlSWB9X52DwQFJm2OHSeVaUXLn
MD5:	FF53442AE314119AF626304FC5DF420D
SHA1:	D10D1F9DF9066D875D3AA94255AD6412D38D75A2
SHA-256:	3B859C6433B64C07F2FFDB7A6F3BF93D82C98DB1F19BFD5940822EECEDFEDE61
SHA-512:	D9EADB65FF36C51E801BC0EF2CCD4CEBC72CE3CC435B008BC234D762A811F79D95C3A4AAF8907F39F407D65A7CDC2CA0F3F89710FD854557CEBE38F9DF08DEE8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bangui) {. {-9223372036854775808 4460 0 LMT}. {-1830388460 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Banjul

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.845033614915018
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dcx79Fw/kXGm2OHF8evUdSaJIWtnvFFsUuv9YvFadndSvvFd:SlSWB9X52Dw7wTm2OHmeVaG4nVu1GfX
MD5:	A8DC20436F4AC11014A23FE0E479DEF0
SHA1:	061D1050C42479E24B3FAED9E97AADD2893C3BD2
SHA-256:	0C250EDB19EBAE2F3EBDACA31B63CD36FE36737846D57F597AB0356D9FA85244
SHA-512:	CB28F9EF90EF157FC63A6A559990A004CA6A34CB1B97B042F5E177FBB8C05A48B89FF5B1E2706CEE4A019B2958AD9C758FBD943ED84DE2E36F365F0896510870
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Banjul) {. {-9223372036854775808 -3996 0 LMT}. {-1830380004 -3996 0 BMT}. {-1104533604 -3600 0 WAT}. {-189385200 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Bissau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.888566941274038
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dc5ixXGm2OHGVkevUd9dV7HvYvF6hSVPVFd:SlSWB9X52D4fm2OHCkeo/DvGMmh
MD5:	9583C83A1209F545BEA5056704237C88
SHA1:	F9B5551C90BD9B9C36A726D16EA99DF7BAF00BFF
SHA-256:	D48EEB7EAED469B7E88B1BFF478099C932951B8648C939BD1F7D585BD12366D8
SHA-512:	C372AD8619EFB9FE1BB7BAE3EE2C1C72F9AAA5669C06248D64AA65E2ED1F4DD50A4F01E7948B4DEA9D44612D177FF89B91572104FB935422BACC23F1DDA18DA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bissau) {. {-9223372036854775808 -3740 0 LMT}. {-1849388260 -3600 0 WAT}. {157770000 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Blantyre

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.925406132896743
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dc8ycXpkdFkXGm2OHT/dvvXdTk8iv:SlSWB9X52DAmpkdJm2OHZPVk8M
MD5:	D233D13F0094A36A46697B628DA53CD7
SHA1:	B4FE4D0F99796811FE2864EB12408F3A655A8841
SHA-256:	EF775D1308B7DAC4C206E5A6C50F15402FE0FF5AF173FF0ED90E8A451940801A
SHA-512:	E473FF78761D2B9BB4205361B42D531EF59B5AB265DE7003D1DBCE564701DC7A7FE75F949848A22E9DA01A5ACE2F23334778E5ED74AD05EE55D3B5AA160F9E50
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Blantyre) {. {-9223372036854775808 8400 0 LMT}. {-2109291600 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Brazzaville

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.974425768793253
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DciE0TMJK/kXGm2OHK1FpsYvUdSaOMYvCn:SlSWB9X52D4q1m2OHm4YVaxLn
MD5:	C070EBAAFCC75AFAE080553599FBB6AA
SHA1:	FD283709C349AA9748107E5B038D4221BDB17757
SHA-256:	B1E556FB71B7EC6F597656F21827A82C384EE9E930B8D6BFE553A032AE5A8A02
SHA-512:	9417F18D89A380F1C459AEB9632AF17B4E67B5E483DBA737C1104002CD2105504B00A609C72D9811A89C042CFE5306A68AAA83B523C7EF91397DF2F039199478
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Brazzaville) {. {-9223372036854775808 3668 0 LMT}. {-1830387668 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Bujumbura

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.995456665899767
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DclKXGm2OHqvTsYvXJddJiv:SlSWB9X52DkRm2OHqv4YPJfJM
MD5:	CCDEA01C6C312506BF98A7B5DD4E9AC2
SHA1:	9B32A8436123C408DF34CDB39036934F1CEA5B56
SHA-256:	74E7692176349F3288D241DE8E273A3009D432FF2FEAC12A928C650E8B312E3A
SHA-512:	303F617663FF94D218809ED3785F7FD262180C5F342087E8A2EC9C63F4CC33C09BF960FAB91D852856BCB62515CA4C726A6B82569BD547FD5A27CEFEBF31ACFC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bujumbura) {. {-9223372036854775808 7048 0 LMT}. {-2524528648 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Cairo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3604
Entropy (8bit):	3.6940532971208615
Encrypted:	false
SSDEEP:	48:5hRg1oCSY0WF6yU0yWZVYbZ0F0ZeTvc0jDlSBFX84aKqITVuV09ONWHr0L0335Ka:Fu0oVy0FUeLIvQV8c0OvOakCUUA
MD5:	F841DF0249A548F92F3F05CCE8A263D0
SHA1:	2EF1CA679AFE58AD8158420CC02B0642BF5ACF51
SHA-256:	C9AA7C223A32A7E45DBBB6F53E45EA2E5C78FE79FD35A7BC3EB8B2FB69C9B04A
SHA-512:	8613476449CD7915ED81A818C4FB376C9A69D7D03EDF8065A65F341D6C8943447985F9067104456251206E52812BE1F6B7356C93F385E1326E2496A7F993178F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Cairo) {. {-9223372036854775808 7509 0 LMT}. {-2185409109 7200 0 EET}. {-929844000 10800 1 EEST}. {-923108400 7200 0 EET}. {-906170400 10800 1 EEST}. {-892868400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857790000 7200 0 EET}. {-844308000 10800 1 EEST}. {-825822000 7200 0 EET}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EET}. {-779853600 10800 1 EEST}. {-762663600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 72

C:\ProgramData\assignee\tcl\tzdata\Africa\Casablanca

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6018
Entropy (8bit):	3.7383939113861557
Encrypted:	false
SSDEEP:	96:bmu1RZIlkTBcltKPw1qA7I2mjvNII00s94SN4rSi0OlpilxO/6NNl:FPZkltKPw1qGiu+SOS3Oo
MD5:	C82A462924484734E930209D914722CF
SHA1:	58D58AA215285262150A5B13F4A554B205222CDB
SHA-256:	B8914785E48B1D22AEC24410F5B86996ECA5562A8AD9C950717780D125C75BB3
SHA-512:	F421A76D7B2C51429EF23FC8D56ECD6D811CD75228222D6A81C32D39931E9A00F99B3DA7DF6DE8905D073AF8B26454A7FFAD9898BA647F5BAD9F58F11B2F9C13
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Casablanca) {. {-9223372036854775808 -1820 0 LMT}. {-1773012580 0 0 WET}. {-956361600 3600 1 WEST}. {-950490000 0 0 WET}. {-942019200 3600 1 WEST}. {-761187600 0 0 WET}. {-617241600 3600 1 WEST}. {-605149200 0 0 WET}. {-81432000 3600 1 WEST}. {-71110800 0 0 WET}. {141264000 3600 1 WEST}. {147222000 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {448243200 3600 0 CET}. {504918000 0 0 WET}. {1212278400 3600 1 WEST}. {1220223600 0 0 WET}. {1243814400 3600 1 WEST}. {1250809200 0 0 WET}. {1272758400 3600 1 WEST}. {1281222000 0 0 WET}. {1301788800 3600 1 WEST}. {1312066800 0 0 WET}. {1335664800 3600 1 WEST}. {1342749600 0 0 WET}. {1345428000 3600 1 WEST}. {1348970400 0 0 WET}. {1367114400 3600 1 WEST}. {1373162400 0 0 WET}. {1

C:\ProgramData\assignee\tcl\tzdata\Africa\Ceuta

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7253
Entropy (8bit):	3.743963604901828
Encrypted:	false
SSDEEP:	96:/D87tz1URbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyo:/AziRNH4Mn82rlo6XIZ9ALeBO
MD5:	96071CE96EF6D15B4C9A77791843F4AB
SHA1:	0F648B077DF21BF09493547F12701C3DF55DA19E
SHA-256:	DCDE14A3352024BF00D80031A0A7DD3A083E5F149356CF828C6CF72AA2F1CF96
SHA-512:	57B4F3AC0BF57C99C6B2BE3873E41BC838F46167EC2BE136D5CFF29DE00BDD9D979C4317D77A6CDECEF0FECE70094ACDC905BFFF511354878751745469273989
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ceuta) {. {-9223372036854775808 -1276 0 LMT}. {-2177451524 0 0 WET}. {-1630112400 3600 1 WEST}. {-1616810400 0 0 WET}. {-1451692800 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427677200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1293840000 0 0 WET}. {-81432000 3600 1 WEST}. {-71110800 0 0 WET}. {141264000 3600 1 WEST}. {147222000 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {448243200 3600 0 CET}. {504918000 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 C

C:\ProgramData\assignee\tcl\tzdata\Africa\Conakry

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.80755519229325
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcmMMmcXGm2OHA75vUdSawFvDlUT3VQWTvYvFYUQxNvDd:SlSWB9X52DCMCm2OHO5VawFvaVvG5Q7B
MD5:	6040E4F819E799478C36139D83668A09
SHA1:	E80FD02A7CBB09023E9EAB37321A9D9548E88E92
SHA-256:	C42D907DC26998373FE331E2674A5BA2D53F904F79C001699CEDF1444A8C849A
SHA-512:	C754F9F6DB792E900F53A19CE6238D16AA259D3C1EC5977ABB58B6B3E2434640EA8548A1E6544BCC8D9DCB3C5F7D5BC282237B1A328833B4A00034FDFCDF5E4A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Conakry) {. {-9223372036854775808 -3292 0 LMT}. {-1830380708 0 0 GMT}. {-1131235200 -3600 0 WAT}. {-315615600 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Dakar

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.8800358345990205
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcXXMFevFSXGm2OH1hvUdSVZ7RYvFSVqXVF7d:SlSWB9X52DKXEwTm2OH1hVb7RGzvB
MD5:	0E274906F7FD9F56110DF6686850CA6B
SHA1:	3DDEBD813F0D606019DCDBB2E908E9FAE8C16F68
SHA-256:	91B6DB5C73F75CFB02E9988BB25EB178AC8639548D1AE5B67F9974481A5D3C7A
SHA-512:	D8E7E220C7FB7293985173EBB46E2CA0015A88169D5D6FE4FD2244A685A9060A297C5F5C3D124F2FD6CFCB6859217CF4D04565C753336079111FBE9BC49A404D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Dakar) {. {-9223372036854775808 -4184 0 LMT}. {-1830379816 -3600 0 WAT}. {-902098800 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Dar_es_Salaam

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.867479750140784
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dc8bEwcXGm2OHSdgYvUXShkWVNIrTXUekxEYPZ5m0lv:SlSWB9X52DJbfTm2OHugYzVYbUJ3ZUe
MD5:	86C55699186DAD95910783501B9A731B
SHA1:	E741A74578794A5E237826B4D4B1B76736513833
SHA-256:	E5F3F69672A0FD2F6BAC92D18ACCF9DDC674AE8C05B8982A33CFE0C6563ED1BF
SHA-512:	FBA58CC1911EE2C9612CCC7C23DA444BF4BD7B462427707C32F4CACA689BDEBD4CB08B59F5219F005B156980B9DB0342268F51EDE27D8B9B52271DDC26D2D8B0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Dar_es_Salaam) {. {-9223372036854775808 9428 0 LMT}. {-1230777428 10800 0 EAT}. {-694321200 9900 0 BEAUT}. {-284006700 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Djibouti

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.0136899912798985
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcRHKQ1eEXGm2OH2dvUdeUcnPvlv:SlSWB9X52DOrULm2OH2d3l
MD5:	3904C75BEB200B26FBAC4A7E7C4CF081
SHA1:	446C8D3DC603AD3B641A3FAE31CAEE9EF3BBA601
SHA-256:	22AB212C615FCA3E511ACC7C8D7A7FD281438EEE32548F09253C99A7B48ED5E5
SHA-512:	D087CD5F09F1C31393BB76F0C425060093EDA8085C1D60BA26C69103DA7AC5A16201211E2D4F6D52D098DAF8925D95FA51B36CF384499BC968F5E63253FB6794
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Djibouti) {. {-9223372036854775808 10356 0 LMT}. {-1846291956 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Douala

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.902751952857552
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcnKtSXGm2OHGXdrsYvUdSa7vYvCn:SlSWB9X52DmCJm2OHGXeYVajLn
MD5:	3D00DBB3182E7F5684CE833476BC8E7E
SHA1:	0C8372B87D7B48F9526FED7300A4B0E1CFD0335C
SHA-256:	7276D8B92DD1B6088B6D8DD6C66EDF5CF156118214454DAF9CBC3C68C7FF2D1B
SHA-512:	7336840B8EF8BD41414620321CF4D94B73B957A5DB75F381BD7D1A7A19CCA0130F2ADF857BA8CAA034E7230639946114A07A7D478D0DFE4430D608F176C91BB3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Douala) {. {-9223372036854775808 2328 0 LMT}. {-1830386328 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\El_Aaiun

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.937111990669582
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dcdw/kXGm2OH5YvUUU4VRQ9YvF2dvDxbv:SlSWB9X52DgwTm2OH5YVU47Q9G8vtL
MD5:	474A28310675A24C0F6E897DD07B3459
SHA1:	6EF16FBCCA28A66361C6ACE75F9DAB0DF6C49C7A
SHA-256:	0429CF1C03C8DDA426E0A341A9C0AAFFE2BD274D524B7BDF3EA22CBB090216DE
SHA-512:	92B1D6B8059844B27DFDD60186036EAC788FA82C5B61E37B5539DE892E8369A88C67EBA54DCE227E2DDAFDCE2EFB76AF0B9D4442A6E20983248D0F9BE04A7510
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/El_Aaiun) {. {-9223372036854775808 -3168 0 LMT}. {-1136070432 -3600 0 WAT}. {198291600 0 0 WET}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Freetown

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.1676212160176584
Encrypted:	false
SSDEEP:	12:MBp52DJTmdHYPuIUhOaZva75ap3/3aHW5cvovr+HOTSPs7WPiFWParSPsQQwVZPs:cQdTesuKVLE7WqY/ELwVZEsBSEMX
MD5:	B3969B1C639C6A28D7EA8EB949DE7508
SHA1:	2367AD8F59396FE934E7BB86F8A9502E67554A95
SHA-256:	BBD13BBD5899CEE08C53CA06431454E8FBF2726C8C614B715C32149B402CB866
SHA-512:	590B1EDB8538EF110CDC3F445DBBA2F484A6CB74D383A7141886DC1E417B16841E6A5579815A7CCA04E45C44B632EA245BA322F31F2BFFDF8344850E722C6A0D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Freetown) {. {-9223372036854775808 -3180 0 LMT}. {-2776979220 -3180 0 FMT}. {-1785712020 -3600 0 WAT}. {-1091487600 -1200 1 SLST}. {-1080949200 -3600 0 WAT}. {-1059865200 -1200 1 SLST}. {-1049326800 -3600 0 WAT}. {-1028329200 -1200 1 SLST}. {-1017790800 -3600 0 WAT}. {-996793200 -1200 1 SLST}. {-986254800 -3600 0 WAT}. {-965257200 -1200 1 SLST}. {-954718800 -3600 0 WAT}. {-933634800 -1200 1 SLST}. {-923096400 -3600 0 WAT}. {-902098800 -1200 1 SLST}. {-891560400 -3600 0 WAT}. {-870562800 -1200 1 SLST}. {-860024400 -3600 0 WAT}. {-410223600 0 0 WAT}. {-397180800 3600 1 SLST}. {-389235600 0 0 GMT}. {-365644800 3600 1 SLST}. {-357699600 0 0 GMT}. {-334108800 3600 1 SLST}. {-326163600 0 0 GMT}. {-302486400 3600 1 SLST}. {-294541200 0 0 GMT}. {-270950400 3600 1 SLST}. {-263005200 0 0 GMT}. {-239414400 3600 1 SLST}. {-231469200 0 0 GMT

C:\ProgramData\assignee\tcl\tzdata\Africa\Gaborone

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.697777826609519
Encrypted:	false
SSDEEP:	6:SlSWB9X52DAV3Lm2OHrPGE5mX8b6VcFm5Cd6K8M:MBp52DAV3LmdHrPfmMGVcFUK8M
MD5:	CD0C5545EB89D2F97C68591443AEE19F
SHA1:	D351EDA9AB51702834C2E1DE85DF5EE9986233CD
SHA-256:	777847FDCE7E18EE00FCD3C3674E614174654388E76D5809C3745BACA6B00378
SHA-512:	58C1184EBD2590B3643E84CE919CBA7AA2615F62D687BFC8381546DC347B17C97D79158CEEE515C68C3E7050AA585AF7EF6E0762766C02FDBC0947D35822440C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Gaborone) {. {-9223372036854775808 6220 0 LMT}. {-2682294220 5400 0 SAST}. {-2109288600 7200 0 CAT}. {-829526400 10800 1 CAST}. {-813805200 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Harare

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.914593410440557
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dc0edFkXGm2OH7dp5vXdKQVSX8iv:SlSWB9X52DledJm2OH35P1Vk8M
MD5:	02FDC96DD509FDC081569C9B478A0C8D
SHA1:	9C29B9CD7947325AADE7F896EE5211FEF1E58E21
SHA-256:	6F55B99772CF5A407BCA0063230EEE6EC3CAA6CF0930770CB65F3D02024E8146
SHA-512:	6F18EE82284E49A836412408B8482F081E1BE05370CB6B4F7F4A4AE23BC382D014B35902482811981793E86D4E3B43A632441C18CB69EF83536C235491FE1847
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Harare) {. {-9223372036854775808 7452 0 LMT}. {-2109290652 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Johannesburg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.638948195674004
Encrypted:	false
SSDEEP:	6:SlSWB9X52DWbAm2OHePP1mXs0//HF20706VcF206KsF:MBp52DWkmdHePP1mcUvFxJVcFEKsF
MD5:	256740512DCB35B4743D05CC24C636DB
SHA1:	1FD418712B3D7191549BC0808CF180A682AF7FC1
SHA-256:	768E9B2D9BE96295C35120414522FA6DD3EDA4500FE86B6D398AD452CAF6FA4B
SHA-512:	DCFF6C02D1328297BE24E0A640F5823BFD23BDE67047671AC18EB0B1F450C717E273B27A48857F54A18D6877AB8132AAED94B2D87D2F962DA43FE473FC3DDC94
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Johannesburg) {. {-9223372036854775808 6720 0 LMT}. {-2458173120 5400 0 SAST}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {-829526400 10800 1 SAST}. {-813805200 7200 0 SAST}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Juba

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	3.9553244896369524
Encrypted:	false
SSDEEP:	24:cQreTn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8Wb2:5An010ilux1XeKXhCvN9U0TMGqCp8jYH
MD5:	CD4491EA48B4560577EFA89D7DEE891E
SHA1:	2E8333ED309B1A3FC3B082693BB351DFE44BA9DD
SHA-256:	DB7E486E87A9089B2CB9C20207A869A8BFBC35D125B797C5FAD4211BA800753E
SHA-512:	BA21C161CFFC47958516BAACD1CED76DAD2074E23E2DCF57C3B01E844302E0E77852772FF21432127CF2CD781C1F94540E6F3EFEE14D3C853E30691F5F0286D8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Juba) {. {-9223372036854775808 7584 0 LMT}. {-1230775584 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1 CAST

C:\ProgramData\assignee\tcl\tzdata\Africa\Kampala

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.753964461375144
Encrypted:	false
SSDEEP:	6:SlSWB9X52DIECJm2OHLfX26Vk/7VV7nRn4:MBp52D5CJmdHLfXvkVNR4
MD5:	F7404FBEB89AFAF18CF1D9DE365707EB
SHA1:	30B9298557C2BF1B4315A106C88FEE4A7289512C
SHA-256:	43C01C74107DE0C94436C663DCFF9A7F983013168B3746CFF765DD03FAA54E2A
SHA-512:	A9D0CF91770461FD959D4B527CA8956860B98175B8D9BCB3A0CDDADAFACFBC6251019830161728CFAB22FA7C1C2F1D6AF0B1B7074791AAAE130FC910D7482BA1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Kampala) {. {-9223372036854775808 7780 0 LMT}. {-1309745380 10800 0 EAT}. {-1262314800 9000 0 BEAT}. {-694319400 9900 0 BEAUT}. {-410237100 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Khartoum

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	3.967955792980027
Encrypted:	false
SSDEEP:	24:cQWe9hXn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8Wb2:5vn010ilux1XeKXhCvN9U0TMGqCp8jYH
MD5:	58D2DAB313AF844E330560A3ECFCB150
SHA1:	2ACBE3F6BFE4A0435BF7B1BE1D1AFEC74F1B61BB
SHA-256:	4AE7C0262505994EFD358165D8A3D896ED3D7766EB2F2EC0029E54CC27663A11
SHA-512:	35CF9D2D1B13C21BD672A1960F2A77A3FD7F52DA208990D4D10891A4FD87CE90E946A5FF1383FB11F0B3675C335B1EAD5B4F1913AB1302ED550CE94D1B21E7A2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Khartoum) {. {-9223372036854775808 7808 0 LMT}. {-1230775808 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1

C:\ProgramData\assignee\tcl\tzdata\Africa\Kigali

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.986262292087319
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcCJOvcXGm2OHjvUVAgSd+iv:SlSWB9X52DROLm2OHjeXM
MD5:	0BC91A5C7C5F86E9DDA0726F4E5C36D3
SHA1:	F83A893EE72FC3762472AA8232832994FF14C0BB
SHA-256:	8AB0E0C036C990B7443AB765D0B5DD3C3954875375F8496CA9D45EAEE9938B67
SHA-512:	D4E972D93E9D386C4F84B63FBE26FB12DF42A93D83802DDB07C23D2022581B73635C00906C190CCD1D0A6963CC2D27A77D6860BAC6EB4F0B42D8F596DB581EEF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Kigali) {. {-9223372036854775808 7216 0 LMT}. {-1091498416 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Kinshasa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.93997005907022
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcqQFtXGm2OHLVVFvvXGlXGZYvCn:SlSWB9X52DDm2OHLNPGl+Ln
MD5:	CFF821349F0FB13E7FD784FDA03D85D6
SHA1:	AF93BBA65222C6766419E75E30E7828576DEFD87
SHA-256:	2B853B554520035B9370A476F3F52E77915BDE97FDB72974E647315F6F70E061
SHA-512:	052550F3D74ED5CEFF7153CFFCA34B3A2EC6D6FD85A07D7B37F02EF611F31A7C02866E84D15CB77600F4DB79974741D7E27E7AD475C4A2F281F3B697253FECC4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Kinshasa) {. {-9223372036854775808 3672 0 LMT}. {-2276643672 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Lagos

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.965079502032549
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcGemFFkXGm2OHWTdvUQDWTFWZRYvCn:SlSWB9X52D4mFJm2OHWTdRDWTGRLn
MD5:	51D7AC832AE95CFDE6098FFA6FA2B1C7
SHA1:	9DA61FDA03B4EFDA7ACC3F83E8AB9495706CCEF1
SHA-256:	EEDA5B96968552C12B916B39217005BF773A99CA17996893BC87BCC09966B954
SHA-512:	128C8D3A0AA7CF4DFAE326253F236058115028474BF122F14AB9461D910A03252FEEB420014CA91ACFBF94DF05FBFCADE98217FC59A86A2581BB68CDC83E88C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lagos) {. {-9223372036854775808 816 0 LMT}. {-1588464816 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Libreville

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.9419343354523955
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dcr70/kXGm2OHHjVFmYvUdSatOYvCn:SlSWB9X52Dgsm2OHKYVatOLn
MD5:	006A98F7A00ECA15355ED194E47106FE
SHA1:	FE26D677D3D4CBCBCD1C927396E5146DEF44CE06
SHA-256:	ABB28F5821C7BD991AAE3E5F70E967B227AF70E07446FB870A24605458773402
SHA-512:	A966D09371427642C4B0DD3CCCF4F2B5708E65684E39E711478D2708C23775280DD8A41E0A64B09C3012688073B6C0B5915CD53470939386819272D25DFC990E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Libreville) {. {-9223372036854775808 2268 0 LMT}. {-1830386268 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Lome

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.901323714732514
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DchFkXGm2OHMXFx5vXQtd:SlSWB9X52DaJm2OHMXr5Pk
MD5:	482A9C32317231A2781462E027FBAFB1
SHA1:	01C6E48EFA6E24441D4BF747E23F4AF7A9FE93B7
SHA-256:	514CD879C63BC4BB05E8BF257D844D8A0D805CA24C2625B90D5B675D3596A31B
SHA-512:	C0FCB4DA4782976D3684B852DBF815B03434277FA60CAE975B38B919A847CBD76997D6EAC993AE94E0075D66B19E1FB84CAAA3FF34C95F6FCF481C31FC7A6372
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lome) {. {-9223372036854775808 292 0 LMT}. {-2429827492 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Luanda

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.9389047305496945
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DccLteEXGm2OHMFnvXfFFTBdxGFFid9cHsrXYvCn:SlSWB9X52Dmm2OHEnPN1BzGyciXLn
MD5:	E9982C54781BE8BE72A0BB3008B3F268
SHA1:	42A964BD048277FD2EAF686414E92CE61223FE33
SHA-256:	91A28C617BC2FC37AFCCEA2F61F6F80211BD9DEACC90527EE2ADA48DD9C4048F
SHA-512:	CF4CA7A9145474FF8A7391795F75A0AA78B292E7ED206ADFC3F4EA865D3FB3607C1A800C1EC3780BAB2A5C612042968298530120AF6EA0E0609210162613BE76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Luanda) {. {-9223372036854775808 3176 0 LMT}. {-2461452776 3124 0 AOT}. {-1849395124 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Lubumbashi

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.002740056079649
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcfpTLXGm2OHca5vXGaBMiv:SlSWB9X52D8pTCm2OHca5PGpM
MD5:	B038D01BEC816AE3BD3ED0AFC1B9FF67
SHA1:	3AB22DA28A747CCB285B989729C845C7E1479F26
SHA-256:	2154AB5CC5822536824C926743359A239074C3601BB705E97ED2CFDDF8F6C1DA
SHA-512:	ED1BDFEACAFD613B9983F26BEF24EE194C81E90A8A00A585F449FC002FB6F80F451BB72F07C3103F3E1F122865A14BEB01F6D670DDAC0EFA890EBFDC3D731E2B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lubumbashi) {. {-9223372036854775808 6592 0 LMT}. {-2276646592 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Lusaka

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.936993889586502
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcOIcXGm2OHenFGxYvXdOcdyXVVkiv:SlSWB9X52D2Tm2OHeFGxYPs7kM
MD5:	DB698834118D1D0A1BC265E9F48B4B23
SHA1:	215D63D9E0EA7CCC2F59802EDDE9E5A5792FAF8A
SHA-256:	FAC07E348D39E39FE4E3E0E99247190D48EAED0F4620BE98C41F6B4369CC1252
SHA-512:	B40D0D9E4DF1DB6B1944CF044A3A7B1479463C48B22508EB15A1A6E1182306C306D4B6D325A652B8897F5AEC8F5C10F9CD79580B3F6CFCF83F118B05D3B98316
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lusaka) {. {-9223372036854775808 6788 0 LMT}. {-2109289988 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Malabo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.8384184690820575
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcoSXGm2OHEVPmYvUdSaQF7lc3QSivZYvCn:SlSWB9X52DzJm2OHEVPmYVaQFqgSyLn
MD5:	240DDA6FCFCC3541922191C40B371815
SHA1:	EE89CA61F05ADDB25D343388CD3D78FC67BCB9F5
SHA-256:	C9245A4AD55ED4D052F2BCFF01A2E851AE68D5C1BE5403F484CEFECFEFE4ADDB
SHA-512:	77708E6DB344DA9F83F459D13C697D64B7902A8B0CC1A95902B49C0E71E3AB5074C7755ED1F3D0AEFFD49D44D7DBEDA9CED60C122F19691B5B6054C75CCBC129
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Malabo) {. {-9223372036854775808 2108 0 LMT}. {-1830386108 0 0 GMT}. {-190857600 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Maputo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.906945970372021
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcfKUXGm2OHoVvXdSF2iv:SlSWB9X52DESm2OHoVPdM
MD5:	5497C01E507E7C392944946FCD984852
SHA1:	4C3FD215E931CE36FF095DD9D23165340D6EECFE
SHA-256:	C87A6E7B3B84CFFA4856C4B6C37C5C8BA5BBB339BDDCD9D2FD34CF17E5553F5D
SHA-512:	83A2AA0ED1EB22056FFD3A847FB63DD09302DA213FE3AB660C41229795012035B5EA64A3236D3871285A8E271458C2DA6FCD599E5747F2F842E742C11222671A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Maputo) {. {-9223372036854775808 7820 0 LMT}. {-2109291020 7200 0 CAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Maseru

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.756948309135006
Encrypted:	false
SSDEEP:	6:SlSWB9X52DZQbm2OHtPsd/Z06VcF206KsF:MBp52DZQmdHtP8hJVcFEKsF
MD5:	EA039E379E21F4AA5B6708EA7FB79266
SHA1:	2BDBF8FAEB7E8831B7B1BD7F4BAFFD5F06139568
SHA-256:	1204BB8517F65D25B8C7C45573D132EDA71B6E3924A4B4D1EE6015FDC84492F7
SHA-512:	77A0A4DBFD69EC77C584E493CA4DB95CB79C24C339B2557E869B5C7845F43AF0772385C1E593DE645622A9ED2BD60A64E66F681C941355580C88E878788AEE2D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Maseru) {. {-9223372036854775808 6600 0 LMT}. {-2109289800 7200 0 SAST}. {-829526400 10800 1 SAST}. {-813805200 7200 0 SAST}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Mbabane

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.963775255719758
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcWE0Ew/kXGm2OHUFvvXdKTjkVvu5L:SlSWB9X52DzjEEm2OHUVPiksF
MD5:	687D08D2AB3C9E411EBD3EA24C88DDCE
SHA1:	695CF95C32AD57BE7D91D8DB77AF1B51E6E285CF
SHA-256:	BABB7BD790BD6333D371B48D80553C379ED563A18034677675BB54FF1653A585
SHA-512:	8EE121392C15C59057982905656E60A02ABE3F95EA9B479EE40AEBB31CED1679FB5AC408BA9733D08D66ED941D2D10F34CC9BA31F1EAF81B1124744FD878D09B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Mbabane) {. {-9223372036854775808 7464 0 LMT}. {-2109290664 7200 0 SAST}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Mogadishu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.795551110316884
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcBEBXCEtXGm2OHsRoxYvXWLcHIsXSh3mH/heHpMGTW3lv:SlSWB9X52DFSbm2OHsOxYPMPRmCRTWl
MD5:	9A1A48A187D0ACC3278D24C248A5F2C5
SHA1:	2348F685DBEF5A331CEA34729C27700BE114B748
SHA-256:	A433DD1167FE4023BD4DBBE411B4FBF807E67612A85E3D869F512FB426D40859
SHA-512:	BD52931F72F1BE437581ABCE2FEE9F8FD59DB5F5C9DCB196349986C2F272ACF09E95570066577007C193303FC53D15DC0D552EFBF6BC31217C2575F40FA7B752
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Mogadishu) {. {-9223372036854775808 10888 0 LMT}. {-2403572488 10800 0 EAT}. {-1230778800 9000 0 BEAT}. {-410236200 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Monrovia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.837701760806169
Encrypted:	false
SSDEEP:	6:SlSWB9X52D3NwTm2OHrFGxYPlHIgafTag/KVK:MBp52D3NwTmdHhmYPdIgah/OK
MD5:	47AD43D6A60EFF7A8D34482906618B4C
SHA1:	9A56DA8F158B8FC91D8AE04B438C7CA157545F63
SHA-256:	90DB2B6966B1215251E77D80B57C2192B5F88B6D3A14E444117FE1B438214406
SHA-512:	D8AE3CF5487551F388486322E4979731A992939C2F974E543EB692604BF9E08083DDD3A9243BA0C01975683FF9EA255E9BAE0F65F7918547B42AA6AEABA581C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Monrovia) {. {-9223372036854775808 -2588 0 LMT}. {-2776979812 -2588 0 MMT}. {-1604359012 -2670 0 LRT}. {73529070 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Nairobi

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.762681539526016
Encrypted:	false
SSDEEP:	6:SlSWB9X52DkWJm2OHsvT5X26V/7VVdekzQ4U/w:MBp52DdJmdHsvVXHVVxQ4U/w
MD5:	616A624AF7C0613DA8682B1371A601EB
SHA1:	B9E9E7DDEDEC09886D8B5EFB0DD03A9F31E55936
SHA-256:	17F2B9541A61E87D6C2924A91AB77F3D08F71DEDD6E3C9AC83892BF68C50A81B
SHA-512:	A7AC4975C147D2B25BDF4C2FBF0F98967E72EC4165BEACE802012590D871B71659F6C1CF297BAEB41CE59190001AEFB17CDA69881D4678333EC74E3C808AD5E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Nairobi) {. {-9223372036854775808 8836 0 LMT}. {-1309746436 10800 0 EAT}. {-1262314800 9000 0 BEAT}. {-946780200 9900 0 BEAUT}. {-315629100 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Ndjamena

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.8064239600480985
Encrypted:	false
SSDEEP:	6:SlSWB9X52DjXm2OHNseVaxCXGFaS1HkFWTvLn:MBp52DjXmdHPVX8aS2yzn
MD5:	459DA3ECBE5C32019D1130DDEAB10BAA
SHA1:	DD1F6653A7B7B091A57EC59E271197CEC1892594
SHA-256:	F36F8581755E1B40084442C43C60CC904C908285C4D719708F2CF1EADB778E2E
SHA-512:	FF74D540157DE358E657E968C9C040B8FE5C806D22782D878575BFAC68779303E6071DC84D6773BC06D299AC971B0EB6B38CA50439161574B5A50FF6F1704046
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ndjamena) {. {-9223372036854775808 3612 0 LMT}. {-1830387612 3600 0 WAT}. {308703600 7200 1 WAST}. {321314400 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Niamey

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.807371561981492
Encrypted:	false
SSDEEP:	6:SlSWB9X52Dsh2wJm2OHYmYVaqrZVXGfxVCQYLn:MBp52DbEmdHYmYVhfYIQsn
MD5:	39CA761FD90A965D67C3DA2191F2D162
SHA1:	A6556E35DBEA29B27862EFD3163D390C2595FB20
SHA-256:	8BF06FBDB8A672A01758C2C1514E76F0A50C0AE9387B9F1AA2C046A5FFBF1989
SHA-512:	61CB1554EE81715523E281DD44965F640A2647286D145BD4DE46B7CF3411231C72C5BF78AB9B9216195B735E3DE937AD17F882BC6412127CF55278B45B6CBAF1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Niamey) {. {-9223372036854775808 508 0 LMT}. {-1830384508 -3600 0 WAT}. {-1131231600 0 0 GMT}. {-315619200 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Nouakchott

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.81486584199261
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcboG0cXGm2OHZHxsYvUdSanVFlUT3VQWTvYvFZ6W3td:SlSWB9X52DqbAm2OHZH+YVanVwVvGZ9n
MD5:	94CFB66CECF511BA9122E5B1D341F066
SHA1:	6403F72FEDF54770D603043BD8843C981F50A91A
SHA-256:	FC8DF2E0F128F0C18CB3AD18C0B5922D0DA48F0C7775E64418218F4C40DCF2FB
SHA-512:	DAB7508F90B8307D8BA8C1FD5AB6DDC1B79313833019A5858B49C9BF3A8A32E9B22C1F7E50B47F48DB5BE9136C05B2CDA3B8A274AE3F08DD6818FE2A697D80C4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Nouakchott) {. {-9223372036854775808 -3828 0 LMT}. {-1830380172 0 0 GMT}. {-1131235200 -3600 0 WAT}. {-286930800 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Ouagadougou

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.993875448661831
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcXCoXGm2OHxFVT5vUdSaPbgod:SlSWB9X52D7m2OHxFVVVaPcw
MD5:	BBB0A077B28482DA5DAC5AD27F92D212
SHA1:	B6C0C25EE7BD6AD793DDB7DB3A395B9CAFC5F9C6
SHA-256:	D106E4E873DB8079A300B7E4E2F01EE3A14C9C6DB8A25E2DB16C61E6CE245FAF
SHA-512:	D2CD780778D4A4DC69786DB6F2E22632BF79619B0D45F38998C98FD4FD2D3E58919BCF5241615130A18BA71B95A78A521A5001240B8B0724445B8075FE2C2454
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ouagadougou) {. {-9223372036854775808 -364 0 LMT}. {-1830383636 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Porto-Novo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.902262882407269
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcyTKMLXGm2OHbeYvUdSadblUT3VOTNZYvCn:SlSWB9X52DWm2OHSYVaoOvLn
MD5:	C8236D27BC1D6C1D82FCEB0776E53D10
SHA1:	9E408B9FC2687887B3B55ED754DA35668F23F30C
SHA-256:	FA547FADF46CBC7441461D46384DF14B0E846BC1D4775B866CACAB33B227B9F1
SHA-512:	75C2C0FD46A85C3AEC045B6AF50901C776C5984CBA0E6915F613B7BE3E1950AF063A54568B147721E678ED864BC0E18E080595540BB48E55B524F7C21608F28F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Porto-Novo) {. {-9223372036854775808 628 0 LMT}. {-1830384628 0 0 GMT}. {-1131235200 3600 0 WAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Sao_Tome

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.9078452305189515
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcOFwFkXGm2OHzT5vXbe1VnvUdSaMvtd:SlSWB9X52DIJm2OHH5PGNVa8X
MD5:	2D3510E2118BE78B266624BE90287D2B
SHA1:	D196E42D4CECB4B982C7189F67ABED958C48F5AA
SHA-256:	7BF0AB09D0936E1FA8F5A97544C92E7861DC111B4CE01D707501B6ED8C7EDDF2
SHA-512:	6EE2B07A472D676CF749461D179DCE02B832195639859A29E5176ACF4ACA00C7622A2F2506326A66D215180E5E15A930B5C7E272728CFBC5F01C534D95B6D7DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Sao_Tome) {. {-9223372036854775808 1616 0 LMT}. {-2713912016 -2192 0 LMT}. {-1830381808 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Africa\Timbuktu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.852118719558368
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsxxowVAIgNGEV4F2DcHdDcxmn:SlSWB9IZaM3y7xawVAIgNTV4F2DwdDwm
MD5:	77C41E72B615D6D304523D34B4426AD3
SHA1:	A5C5E73496A7F2A2C554E32B72C646FD29E19BC6
SHA-256:	46028CA2C897365227736B6DEAC7186DD7609914D3143B2E58559A2616235E9C
SHA-512:	249F24B3FED160A1DF6B1DDD41FD4BE4CF75F39113B4CDD63681FF61B3390F9468142BA8B0AE49DD5A86B25925DE17C51EA08BD2BC288F6A4A622693EC9D3752
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Bamako)]} {. LoadTimeZoneFile Africa/Bamako.}.set TZData(:Africa/Timbuktu) $TZData(:Africa/Bamako).

C:\ProgramData\assignee\tcl\tzdata\Africa\Tripoli

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5822
Entropy (8bit):	3.7505423379992147
Encrypted:	false
SSDEEP:	96:tFNCdLwvFZRMoUQoBTOe8+JUWEkSAI38kRCT+87tFIW5IIP7GaXbb:DRMoUQoBfC4f
MD5:	9C0BC05A9FD4405AFC3CDB7E32B6A015
SHA1:	F2565C23FDC96C947A70F2E389E640423B7466C4
SHA-256:	4A972852F65E4CD07747AABE67B9A56001AD405E4F96A25F5E827B3D38F31AE9
SHA-512:	0B2864A599437D1B860E82F78349F7781AD53E9FF7A7C1DD938B1BDDB08D6E79FA97546403A23A20E3F74C2AC637E8EAF6A5FDE9F45D274D188D12E7252949D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tripoli) {. {-9223372036854775808 3164 0 LMT}. {-1577926364 3600 0 CET}. {-574902000 7200 1 CEST}. {-512175600 7200 1 CEST}. {-449888400 7200 1 CEST}. {-347158800 7200 0 EET}. {378684000 3600 0 CET}. {386463600 7200 1 CEST}. {402271200 3600 0 CET}. {417999600 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {465429600 3600 0 CET}. {481590000 7200 1 CEST}. {496965600 3600 0 CET}. {512953200 7200 1 CEST}. {528674400 3600 0 CET}. {544230000 7200 1 CEST}. {560037600 3600 0 CET}. {575852400 7200 1 CEST}. {591660000 3600 0 CET}. {607388400 7200 1 CEST}. {623196000 3600 0 CET}. {641775600 7200 0 EET}. {844034400 3600 0 CET}. {860108400 7200 1 CEST}. {875919600 7200 0 EET}. {1352505600 3600 0 CET}. {1364515200 7200 1 CEST}. {1382659200 3600 0 CET}. {1395964800 7200 1 CEST}. {1414713600 3600 0 CET}. {1427414400 7200 1 CE

C:\ProgramData\assignee\tcl\tzdata\Africa\Tunis

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	4.074604685883076
Encrypted:	false
SSDEEP:	12:MBp52DgmdHjPbwSRjneMVyDKCNFWLFyBXS9/3S3K/CBmvyncSuZSqLS2C6oPwVFD:cQUejbwSRyS2Uyc+FcJLKgzmcx9b
MD5:	1899EDCB30CDDE3A13FB87C026CD5D87
SHA1:	4C7E25A36E0A62F3678BCD720FCB8911547BAC8D
SHA-256:	F0E01AA40BB39FE64A2EB2372E0E053D59AA65D64496792147FEFBAB476C4EC3
SHA-512:	FD22A2A7F9F8B66396152E27872CCBA6DA967F279BAF21BC91EF76E86B59505B3C21D198032B853427D9FFAB394FBB570F849B257D6F6821916C9AB29E7C37A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tunis) {. {-9223372036854775808 2444 0 LMT}. {-2797202444 561 0 PMT}. {-1855958961 3600 0 CET}. {-969242400 7200 1 CEST}. {-950493600 3600 0 CET}. {-941940000 7200 1 CEST}. {-891136800 3600 0 CET}. {-877827600 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-842918400 3600 0 CET}. {-842223600 7200 1 CEST}. {-828230400 3600 0 CET}. {-812502000 7200 1 CEST}. {-796269600 3600 0 CET}. {-781052400 7200 1 CEST}. {-766634400 3600 0 CET}. {231202800 7200 1 CEST}. {243903600 3600 0 CET}. {262825200 7200 1 CEST}. {276044400 3600 0 CET}. {581122800 7200 1 CEST}. {591145200 3600 0 CET}. {606870000 7200 1 CEST}. {622594800 3600 0 CET}. {641516400 7200 1 CEST}. {654649200 3600 0 CET}. {1114902000 7200 1 CEST}. {1128038400 3600 0 CET}. {1143334800 7200 1 CEST}. {1162083600 3600 0 CET}. {1174784400 7200 1 CEST}. {1193533200

C:\ProgramData\assignee\tcl\tzdata\Africa\Windhoek

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6288
Entropy (8bit):	3.7400827352074417
Encrypted:	false
SSDEEP:	96:Qsj67E2442ZG5tD58bEpEnvR0NnrVycST8a6l+2BTkXj0ErPVAic0jQRJo5v:Qsj6v2Z+qbEpEn+fBvkpGYv
MD5:	44AC624997617774CDF0E2E63D923771
SHA1:	C2D2EF5A46A73F5BDD33F1E37A3D9867CB9FCAC1
SHA-256:	ED790E4D5DE1588489108DAE81FCACB2F93913026334614E651FD9EBD1923206
SHA-512:	62D6E7C8F2C310B2CD7C7E957C10BE8FECE341EEC27E2B4896827C0709DB29B3DC33D2CF748001B06F764F5C7FCC639C603FA3ADC119074F54F8A2B5EB1D0C8F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Windhoek) {. {-9223372036854775808 4104 0 LMT}. {-2458170504 5400 0 SWAT}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {637970400 7200 0 CAT}. {765324000 3600 0 WAT}. {778640400 7200 1 WAST}. {796780800 3600 0 WAT}. {810090000 7200 1 WAST}. {828835200 3600 0 WAT}. {841539600 7200 1 WAST}. {860284800 3600 0 WAT}. {873594000 7200 1 WAST}. {891734400 3600 0 WAT}. {905043600 7200 1 WAST}. {923184000 3600 0 WAT}. {936493200 7200 1 WAST}. {954633600 3600 0 WAT}. {967942800 7200 1 WAST}. {986083200 3600 0 WAT}. {999392400 7200 1 WAST}. {1018137600 3600 0 WAT}. {1030842000 7200 1 WAST}. {1049587200 3600 0 WAT}. {1062896400 7200 1 WAST}. {1081036800 3600 0 WAT}. {1094346000 7200 1 WAST}. {1112486400 3600 0 WAT}. {1125795600 7200 1 WAST}. {1143936000 3600 0 WAT}. {1157245200 7200 1 WAST}. {1175385600

C:\ProgramData\assignee\tcl\tzdata\America\Adak

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.859401130903035
Encrypted:	false
SSDEEP:	96:sGWQm82WEXKfYoba+HbVBoqwXjvfolmgmkHvQZTk:sGWQmGa+HbVBoqSvfczms
MD5:	53B6CE72FB8A751B3BC932B368CB2511
SHA1:	4161D34F0AC339A31A32DD003CB9D0C289F25132
SHA-256:	64A9B46ADDA15DA226C1368CFC0663AE28251A31E25D1B7F148A8BC662B216CC
SHA-512:	2553814D6D0C096BB5F51DEC94A54CEC99A65A969BC4F963F0C8EE89F3B95244B84BC7CADA251BF2724204EF70B5E86FB56E0032492CCC6330B45A433CAEBDD9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Adak) {. {-9223372036854775808 44001 0 LMT}. {-3225356001 -42398 0 LMT}. {-2188944802 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3

C:\ProgramData\assignee\tcl\tzdata\America\Anchorage

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.8881028022209834
Encrypted:	false
SSDEEP:	96:WERpxXw34N+YXSUKC8aaIqDPRs/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8s:WEZd6M/4h5sBPy+CMt/ElALLVuAH
MD5:	A1CD6589E2F4580D7334F1ED9E5FF7AB
SHA1:	593F87F30B8B766389E30322194C25441EFED694
SHA-256:	48792AAD13FB634F3BFE27B1C3752AE50950818DFF2D6B598E4AF449DC3B187B
SHA-512:	63F6197E738C51EFB830CB8440F93EDC27EACA035BA8A75383FD095928E8DEC05C305EB559018E8D4F5778D76E6CC4D659DF8F408DAA33574F47B8C7F344F877
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Anchorage) {. {-9223372036854775808 50424 0 LMT}. {-3225362424 -35976 0 LMT}. {-2188951224 -36000 0 CAT}. {-883576800 -36000 0 CAWT}. {-880200000 -32400 1 CAWT}. {-769395600 -32400 0 CAPT}. {-765378000 -36000 0 CAPT}. {-757346400 -36000 0 CAT}. {-86882400 -36000 0 AHST}. {-31500000 -36000 0 AHST}. {-21470400 -32400 1 AHDT}. {-5749200 -36000 0 AHST}. {9979200 -32400 1 AHDT}. {25700400 -36000 0 AHST}. {41428800 -32400 1 AHDT}. {57754800 -36000 0 AHST}. {73483200 -32400 1 AHDT}. {89204400 -36000 0 AHST}. {104932800 -32400 1 AHDT}. {120654000 -36000 0 AHST}. {126705600 -32400 1 AHDT}. {152103600 -36000 0 AHST}. {162388800 -32400 1 AHDT}. {183553200 -36000 0 AHST}. {199281600 -32400 1 AHDT}. {215607600 -36000 0 AHST}. {230731200 -32400 1 AHDT}. {247057200 -36000 0 AHST}. {262785600 -32400 1 AHDT}. {278506800 -36000 0 AHST}. {294235200

C:\ProgramData\assignee\tcl\tzdata\America\Anguilla

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.022817841749413
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE/8/edSXGm2OHrWTr5vUd9JlVvwvYv:SlSWB9X5290/8YJm2OHrWTr5GVr
MD5:	400195CCBE9C119FF8E842171A021DFE
SHA1:	F182B870106965317957A19B635F6BFBA9F463DF
SHA-256:	4D59A7AA667B52D8FED39DE017A677C0DEF658F43F68B3FD82AF7F31886D886D
SHA-512:	DE14E93EAD97A908D1978944A6E9331ACC6D7E1EDFDFBE4DF9CC547D9BB5625191FBD3E9FF9D30F69601E549B1D2498FA1BA3EECFCC2F73ABD2717C21C711D38
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Anguilla) {. {-9223372036854775808 -15136 0 LMT}. {-1825098464 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Antigua

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.914323832612478
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE//MFeEXGm2OHGFVFGevUd+RyUXVVvawch0/HRR/vwvC:SlSWB9X5290//MFeLm2OHSVke50UXVVL
MD5:	1D8C8679C62FD5B340C2C8DFFB4D8F25
SHA1:	653B9DAEE2F0D55414E29C0AEDD7E34423DB3FA8
SHA-256:	DF136617165B77471C61A51B6D0AECEA7FBCFA3D83862BBB9733BD32073D57C3
SHA-512:	FDD602AECD195B96199F0A8B7041F160DA09400C4E6A56BB2BB94603378837150382490DAA8443FA6AD1FA0288A9913E3DF3E57E671933B69F721DB1EFEF5CD7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Antigua) {. {-9223372036854775808 -14832 0 LMT}. {-1825098768 -18000 0 EST}. {-599598000 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Araguaina

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6907
Entropy (8bit):	3.789967285899392
Encrypted:	false
SSDEEP:	192:lP+2+j+R+u+W+L+M+A+r+L+v+8+h+2+M+w+b+v+8+/+C+jZ+E+2+A+O+8R+G+Y43:Ecbb8B4
MD5:	E6F8DBD4BF73C7303F91EF92E9BDA8F9
SHA1:	DC92FDE74518D788111D01CBB881B37E46EC5F22
SHA-256:	13899639D3FC0D6B54661E5B35F0546A83FD84F9C8A9E0116791F683574F3714
SHA-512:	DC75600849457BE313FFB55B99036E2914CEEBA670724C366207FF227C399FCEFBBE5A2F3B1E1805C17E4C87F36619C357A3B976726BF9D381A11724E4D5F170
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Araguaina) {. {-9223372036854775808 -11568 0 LMT}. {-1767214032 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Buenos_Aires

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2010
Entropy (8bit):	3.9779263835893843
Encrypted:	false
SSDEEP:	48:5WcafJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwr:vEJaGK9+LUlT/uXgeVL+PRjG3dUXHg67
MD5:	2DDA63C37B5BDAB56F9250A98A53EACE
SHA1:	6CA1A502AD4D943A9F5E7824E48546BBD19C571D
SHA-256:	B808C84849A1D5D61F223B8A6155EDA91BA1E575C0B8CF4CDD0C499CF499C042
SHA-512:	E1A2F9B81A5ACAF0C6B30363074CDA524A341446F2C2F5F7010BBDA0F57BD8C131C31D28E23A4E62C06E3749B251F178C30C556F24B715D4B6558F09A8CEC137
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Buenos_Aires) {. {-9223372036854775808 -14028 0 LMT}. {-2372097972 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Catamarca

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	3.9634733329308918
Encrypted:	false
SSDEEP:	48:5f4fJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwR4:N+JaGK9+LUlT/uXgeVL+PRjG3dUXHQ33
MD5:	9F9AC2706BED81376AA10BFCFAD684DD
SHA1:	1FCB09ABDDFA9CFD2EA099B284A599E2CAAE3BF3
SHA-256:	69D8A30B3FD4AD2C5DC4545B81EFE322570D90B78FA2DAC85897AEF53842CFA9
SHA-512:	4713EC8CFB0123596F0F36DBAB3F23A1889872F2CA891FF6F9DE319C54AC47201C697ACD6B670DF2561A5635D605425BA812CA23F070E2ACE9E058FAA1804E0C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Catamarca) {. {-9223372036854775808 -15788 0 LMT}. {-2372096212 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\ComodRivadavia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.672788403288451
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs290/MquQ90/MMXAv:MBaIMY/Mhp/MP290/MquQ90/MH
MD5:	42D568B6100D68F9E5698F301F4EC136
SHA1:	E0A5F43A80EB0FAAFBD45127DCAF793406A4CF3A
SHA-256:	D442E5BBB801C004A7903F6C217149FCDA521088705AC9FECB0BC3B3058981BF
SHA-512:	99580239B40247AF75FFAA44E930CDECB71F6769E3597AC85F19A8816F7D0859F6A0D5499AFAC2FA35C32BA05B75B27C77F36DE290DD0D442C0769D6F41E96DA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca).

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Cordoba

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	3.9677183425688307
Encrypted:	false
SSDEEP:	48:5zxpfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGws:1x9JaGK9+LUlT/uXgeVL+PRjG3dUXHQr
MD5:	61BA43D4E743A7C289D0DD4753AF5266
SHA1:	650558730C9E32A5F532CBA08147516304DE7023
SHA-256:	AD6E551ED3466EB78770620B79A72A4F145A6D587E2E0956E87BE110952252E1
SHA-512:	5CFC96CDF1D86CE95E14FABF5861FDCEEB0EC5A3B7A9A55D18163DF6B01FA1BDD0A876AB15C5828409ADC51B3A5A26AC4C1F875ECD32EB6CD8729B98E34DD72E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Cordoba) {. {-9223372036854775808 -15408 0 LMT}. {-2372096592 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Jujuy

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	3.973466609224067
Encrypted:	false
SSDEEP:	48:5rCfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRr:FcJaGK9+LUlT/uXgeVL+PRjG3dUXfrBV
MD5:	F54525F3F2427C9F752F3C5D3762CEA2
SHA1:	9A0C4779B04622D521884F1DDA88744E10A9B72E
SHA-256:	643BBFE9E8BDCF711AFD52BA189E675B3DD5B6A0E47E204F95EC5AC4BAD4B623
SHA-512:	AB2F99DC324D64CC42CE487A48AAC5096185A8531E0756551A0239D49A3CF8A7972F6858167A3864CFBEF3F13A15F47F99D10B04E78BEB33E3CDB3735FE245A5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Jujuy) {. {-9223372036854775808 -15672 0 LMT}. {-2372096328 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}. {

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\La_Rioja

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2067
Entropy (8bit):	3.961168755371772
Encrypted:	false
SSDEEP:	48:5J6fJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRU:HkJaGK9+LUlT/uXgeVL+PRjG3dUXHv63
MD5:	C4276571AC47CAB0A2866D228DB5356C
SHA1:	8088B248BD6801EF8A537A81F3BBD1AA72332889
SHA-256:	D94723529462DC8DDC82AF71268AD0EA1E5ABDD1AE56CF95C2787E6D55DFC366
SHA-512:	6B5198BD963CFC60B32328B427C937B562BFB7E9EE2B16077DA6AC7E8ED6AA8538A7B2353F501642B74378E29AEA2535CF89C2B71DCF25EE829EE8D097CD944F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/La_Rioja) {. {-9223372036854775808 -16044 0 LMT}. {-2372095956 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Mendoza

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	3.9713587246734114
Encrypted:	false
SSDEEP:	48:5YefJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRn:C4JaGK9+LUlT/uXgeVL+PRjG3dUXp9Im
MD5:	615EA020751D8AF717840FE95A5657A8
SHA1:	1B95B53EEAA3C19335EEDCB645237EC9B779A0E2
SHA-256:	9F4CD0AD99421209D3240F067F763C957B395D1ECC80881D51EFAE6DDEE0A375
SHA-512:	E83A7CCFBF5EA830A63E6C655611165FE4B260F13F7FB2234D6A9BA859C93CE6E32C2F691A10DBE07966A0D162D7CCACE0E8B1F66159660358E835FDF7832146
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Mendoza) {. {-9223372036854775808 -16516 0 LMT}. {-2372095484 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Rio_Gallegos

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	3.9709004305556337
Encrypted:	false
SSDEEP:	48:5mpfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRp:o9JaGK9+LUlT/uXgeVL+PRjG3dUXHg63
MD5:	E9C3978CF8824F03582C0C4DBB086138
SHA1:	854A28BA75715E35AC79A19875B510D87C102D36
SHA-256:	DE502BAF9DDD8BD775C1B4AC5681CD36C639ABC2A3D59579A89F6D3786FC6E27
SHA-512:	B8686E0D9FCF4783DF732676F5550EF30050CD20397086CE2DF77D935F64F02BAB8333C72D3B831627F322B9CF1289243E4B9E06BEB4F7668224B268E4CDF07A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Rio_Gallegos) {. {-9223372036854775808 -16612 0 LMT}. {-2372095388 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Salta

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1974
Entropy (8bit):	3.957678973420544
Encrypted:	false
SSDEEP:	48:5VgfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRi:72JaGK9+LUlT/uXgeVL+PRjG3dUXHQ3T
MD5:	9BC9148D20A804AB42732F1C13C28A1C
SHA1:	910E54C41F70CB3F51A5DF08016FCFCFA1083921
SHA-256:	262DFD69F14B658DC8B8786204973A225C4ABA8EDC2BF33B025B77BD97D1693C
SHA-512:	65FD9E9464402683FB8C4D97A512D50A7F19A0D53BC6B5CA0B2A30739DC4745CC178ACD0A02019E1B4587096F30C917D3B8FE0D3ED1883014D7AF90FD6AFD0AA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Salta) {. {-9223372036854775808 -15700 0 LMT}. {-2372096300 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}. {

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\San_Juan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2067
Entropy (8bit):	3.965568294539527
Encrypted:	false
SSDEEP:	48:5jXufJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGws:14JaGK9+LUlT/uXgeVL+PRjG3dUXHv6B
MD5:	C6CFB7423D26A86924BA8A86494A268D
SHA1:	68EC28EE2B8EFCC72E0875F968FE616FB71ED217
SHA-256:	09F1CE3527B5C3F8D58D79901B6129459D4DC1AEEF80F19338ECCF764668DFF3
SHA-512:	7C4835FDA7AA229E3AABE27F9AA1D1724B4CA6537E58035E1D60CFB446944FBD33BC806B64224B20CDC3315F8C6AE6F34B55D5333E5857AF6A34AD124CEF343B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Juan) {. {-9223372036854775808 -16444 0 LMT}. {-2372095556 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\San_Luis

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	3.9816705980879408
Encrypted:	false
SSDEEP:	48:58kfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRf:KaJaGK9+LUlT/uXgeVL+PRjG3dUXHLjD
MD5:	CEF249A57B470BABCC515865FD2E3A19
SHA1:	AFC88EA45BFE40C049F3704D0556816070783F0E
SHA-256:	A64FA78ED22A518ECBA3F4375726D70E2213DED8F24BD07251AF00D99F5A330E
SHA-512:	4515A5BC5D970B1F2C9C83962F993454D206C811F0AA6241C97475DCA6F5FEFBCE927A7BEDD9419FCE45D59110899D6D6344DFA73622141CD665B26ED0C6A42E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Luis) {. {-9223372036854775808 -15924 0 LMT}. {-2372096076 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Tucuman

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2067
Entropy (8bit):	3.9614731054580163
Encrypted:	false
SSDEEP:	48:5yM9EfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGI:b96JaGK9+LUlT/uXgeVL+PRjG3dUXHQA
MD5:	17200080F2840A40EEFB902AFFB858FF
SHA1:	B33794EB96EE42C555B32A2CEDD27ABE0224C7BC
SHA-256:	93B07C3BD7CE711650B3A21F413C7D5B952DAB03E0BAFAED687E676949A2EF6F
SHA-512:	060C2860E356631B293EE3EAAF9D71FEEB07B7D0A42211859CB8E4B99A1C812BD9AF079A82D4E55771A78FBF591D6B0D25FDC54F8DA2D2F594F0E9B213EA271F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Tucuman) {. {-9223372036854775808 -15652 0 LMT}. {-2372096348 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Argentina\Ushuaia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	3.9614879453725877
Encrypted:	false
SSDEEP:	48:56YfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRB:QeJaGK9+LUlT/uXgeVL+PRjG3dUXHg6P
MD5:	A254EF7A0166FBADB11644105C8E7BCA
SHA1:	30E6C33FA28691857CB0ACA4DB4B465FEA31A84A
SHA-256:	4E93A670621EBFD5FD996F8BC6C6C4121DE2D3CFAE221CB2A7C51C77428F99FF
SHA-512:	A28CD45CB352CBCC27C8BAE7B3D176C61526B763394DAAF5FB7A779DB51603290E3C2A3A3D922B70AA19ABB80FA1E4EED501D591F9E111CD6C19093BDAF7B9AC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Ushuaia) {. {-9223372036854775808 -16392 0 LMT}. {-2372095608 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\ProgramData\assignee\tcl\tzdata\America\Aruba

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.898934106142183
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE/nUXGm2OH5vkevUd57/FVFkEiQG3VFpRR/vwvYv:SlSWB9X5290/bm2OH58ey7/F8WUF/R/r
MD5:	D93B07F2D32C29DF52A7FC350C6CB5A1
SHA1:	223E79B37CA8F6A8ECE0BC6922164595B9A9265A
SHA-256:	9955C48CB1F52285E1FDAC6CB1CD4E461F74A380D66B9D75A2F3D6553873F126
SHA-512:	2C05E1EB4EA4D8722E9F9791F7EFDB9AC603BC8A28BB51B9171AE55E88A8B450D5E46C7FFB63EEAE06235BC74D761F844DD5F74D729B64BA3ABA127797AA4805
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Aruba) {. {-9223372036854775808 -16824 0 LMT}. {-1826738376 -16200 0 ANT}. {-157750200 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Asuncion

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7810
Entropy (8bit):	3.766817466650462
Encrypted:	false
SSDEEP:	192:5xEwkqiLgvyCZ1Q79FGs6R61Ec//nvRGoTcP5zzIhwrwsEW8dmsyoTrhxXrdCrQ3:5NBeQy
MD5:	9981F5B3F787131FCB96169B8CAD19A6
SHA1:	987B68F1597F932178E92F12D1A3431A923473D0
SHA-256:	99D494C820C9DD238CFA13775C8B4D8D8B401BD2EADA65F8B46CC75369FAA9C9
SHA-512:	763ACB02FDDA95065BE0C090FCF6BA7E515E97A6F33185E577F46C597C16B47653159EA0573ED1011B1F29979A0B9E94B9CA2BE688057BD231ECB35AA0399CD1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Asuncion) {. {-9223372036854775808 -13840 0 LMT}. {-2524507760 -13840 0 AMT}. {-1206389360 -14400 0 PYT}. {86760000 -10800 0 PYT}. {134017200 -14400 0 PYT}. {162878400 -14400 0 PYT}. {181368000 -10800 1 PYST}. {194497200 -14400 0 PYT}. {212990400 -10800 1 PYST}. {226033200 -14400 0 PYT}. {244526400 -10800 1 PYST}. {257569200 -14400 0 PYT}. {276062400 -10800 1 PYST}. {291783600 -14400 0 PYT}. {307598400 -10800 1 PYST}. {323406000 -14400 0 PYT}. {339220800 -10800 1 PYST}. {354942000 -14400 0 PYT}. {370756800 -10800 1 PYST}. {386478000 -14400 0 PYT}. {402292800 -10800 1 PYST}. {418014000 -14400 0 PYT}. {433828800 -10800 1 PYST}. {449636400 -14400 0 PYT}. {465451200 -10800 1 PYST}. {481172400 -14400 0 PYT}. {496987200 -10800 1 PYST}. {512708400 -14400 0 PYT}. {528523200 -10800 1 PYST}. {544244400 -14400 0 PYT}. {560059200 -10800 1 PYS

C:\ProgramData\assignee\tcl\tzdata\America\Atikokan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.582750266902939
Encrypted:	false
SSDEEP:	6:SlSWB9X5290/qlfbm2OHvcFGxYP329V/uFn/TUs/uFn/lHIs8/kRm5/uFb/C/iin:MBp5290/emdHLYP323/uFn/9/uFn/dBs
MD5:	66777BB05E04E030FABBC70649290851
SHA1:	97118A1C4561FC1CC9B7D18EE2C7D805778970B8
SHA-256:	2C6BBDE21C77163CD32465D773F6EBBA3332CA1EAEEF88BB95F1C98CBCA1562D
SHA-512:	B00F01A72A5306C71C30B1F0742E14E23202E03924887B2418CA6F5513AE59E12BC45F62B614716BBE50A7BEA8D62310E1B67BB39B84F7B1B40C5D2D19086B7C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Atikokan) {. {-9223372036854775808 -21988 0 LMT}. {-2366733212 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765388800 -18000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Atka

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.761501750421919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvt2IAcGE/ol7x+IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9F290/ola
MD5:	E641C6615E1EF015427202803761AADD
SHA1:	E254129517335E60D82DFE00C6D5AF722D36565A
SHA-256:	9C546927B107BB4AB345F618A91C0F8C03D8A366028B2F0FCBF0A3CE29E6588E
SHA-512:	B7D34B1EA0D6722D7BFCD91F082D79EE009B97A2B5684D76A3F04CB59079637134275CF9A0306B9F4423A03CC0C2AB43994207D1B209161C893C2C6F3F3B6311
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:America/Atka) $TZData(:America/Adak).

C:\ProgramData\assignee\tcl\tzdata\America\Bahia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1974
Entropy (8bit):	3.912191186217954
Encrypted:	false
SSDEEP:	48:5CP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wt+x3+XG+M+Y+v+c+M+/2+v+ux+/+C+jZl:MP+2+j+R+u+W+L+M+A+r+L+v+Wt+h+25
MD5:	6D2CD468DF52E8CA7B1B5578DE0B04C5
SHA1:	AEC04A61823815EF0414E8A88C860F0BDB6F3190
SHA-256:	BF7A9E732483DD1D3C7246B422A5B4CF3F496B001B70D60A9F510D84F14D9DDC
SHA-512:	248520173EFFBD49506095AD7F9E4BC6B7D819187EEF2BD39A5F94AC92D8C8F26647BEBAFF5C9802ECA300CBF6BCCDD9D2E05E998457D7357238B89FA76A338B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia) {. {-9223372036854775808 -9244 0 LMT}. {-1767216356 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7200 1

C:\ProgramData\assignee\tcl\tzdata\America\Bahia_Banderas

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6625
Entropy (8bit):	3.791871111929614
Encrypted:	false
SSDEEP:	192:NqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmbwBlhcCLfYkNRfsNz:NqZL/1dCYDDCxyH4RxGIJkYWXsWwav7S
MD5:	6A18936EC3AA0FCEC8A230ADAF90FF1E
SHA1:	B13B8BF1FD2EEED44F63A0DC71F0BCE8AC15C783
SHA-256:	974481F867DEA51B6D8C6C21432F9F6F7D6A951EC1C34B49D5445305A6FB29B7
SHA-512:	75AA7A3AE63ED41AFF6CF0F6DC3CA649786A86A64293E715962B003383D31A8AD2B99C72CE6B788EC4DFF1AF7820F011B3F1FD353B37C326EF02289CE4A061BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia_Banderas) {. {-9223372036854775808 -25260 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -

C:\ProgramData\assignee\tcl\tzdata\America\Barbados

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	413
Entropy (8bit):	4.429320498710922
Encrypted:	false
SSDEEP:	12:MBp5290eNJmdH9Gcvm/uFkCFP/K/uFkCFks/v/h/uFkCFFoI/qZ/uFkCF3dX/r:cQT7enmSkC9/KSkCT/BSkCLl/wSkCj/r
MD5:	49EED111AB16F289E7D2D145A2641720
SHA1:	2F0A37524209FC26421C2951F169B4352250ED9E
SHA-256:	E7415944397EF395DDBD8EACB6D68662908A25E2DB18E4A3411016CBB6B8AFC6
SHA-512:	3AD4511798BA763C4E4A549340C807FE2FDF6B107C74A977E425734BBADDFF44ADAA68B5AE1F96170902A10208BC4BBF551C596EB1A3E292071549B8F3012A35
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Barbados) {. {-9223372036854775808 -14309 0 LMT}. {-1451678491 -14309 0 BMT}. {-1199217691 -14400 0 AST}. {234943200 -10800 1 ADT}. {244616400 -14400 0 AST}. {261554400 -10800 1 ADT}. {276066000 -14400 0 AST}. {293004000 -10800 1 ADT}. {307515600 -14400 0 AST}. {325058400 -10800 1 ADT}. {338706000 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Belem

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	4.083219722112219
Encrypted:	false
SSDEEP:	24:cQYe3gqc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+p+C:5VgP+Ih+j+R+u+W+iW+M+A+r+hN+gU+O
MD5:	AA9BD809DCA209AFDF0D57752F6871F6
SHA1:	7C05A9FC831584CB5B9082073284736D000E9D5D
SHA-256:	4E8AC6FCDBC60264962D43B734A760A307C5E30D35A196289FDA8C87FC023B5C
SHA-512:	47AB548EBF090CAE6E59464A7AC9348F0F505E9B7EB3DED24EB7C7F11BA6EB92BDDC3F99E4B7C77046C82B54D7FC4D44996D46869DA3BD326FD25944A492DFA7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belem) {. {-9223372036854775808 -11636 0 LMT}. {-1767213964 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {590032800 -10800

C:\ProgramData\assignee\tcl\tzdata\America\Belize

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1829
Entropy (8bit):	3.9821437108187077
Encrypted:	false
SSDEEP:	48:5cmCSSTSnwoaUReqGtp4Hs7Ux8SJ8ltVDymDxUM/mjM/sQ:+mCSSTSnwoaUReqGtiHs7i8M8ltVDymt
MD5:	038937E745DFE0D09104C42545D49176
SHA1:	A453C663224F479A06AF655086D07E78672A5FAF
SHA-256:	762DF75CF9DA55B24834D6FB1BD33772F865365F86B8B7BE03520481CFA96C2F
SHA-512:	13464DB9200232B1C0B7F86DCD6650EB2BAAFF6097E9D269660706DFC3B7E5FFF6707BC6C7089D521566DC20CADE07AD3F3A570BBE2D702F95D476CB7EFF33F0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belize) {. {-9223372036854775808 -21168 0 LMT}. {-1822500432 -21600 0 CST}. {-1616954400 -19800 1 CHDT}. {-1606069800 -21600 0 CST}. {-1585504800 -19800 1 CHDT}. {-1574015400 -21600 0 CST}. {-1554055200 -19800 1 CHDT}. {-1542565800 -21600 0 CST}. {-1522605600 -19800 1 CHDT}. {-1511116200 -21600 0 CST}. {-1490551200 -19800 1 CHDT}. {-1479666600 -21600 0 CST}. {-1459101600 -19800 1 CHDT}. {-1448217000 -21600 0 CST}. {-1427652000 -19800 1 CHDT}. {-1416162600 -21600 0 CST}. {-1396202400 -19800 1 CHDT}. {-1384713000 -21600 0 CST}. {-1364752800 -19800 1 CHDT}. {-1353263400 -21600 0 CST}. {-1333303200 -19800 1 CHDT}. {-1321813800 -21600 0 CST}. {-1301248800 -19800 1 CHDT}. {-1290364200 -21600 0 CST}. {-1269799200 -19800 1 CHDT}. {-1258914600 -21600 0 CST}. {-1238349600 -19800 1 CHDT}. {-1226860200 -21600 0 CST}. {-1206900000 -19800 1 CHDT}.

C:\ProgramData\assignee\tcl\tzdata\America\Blanc-Sablon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.599775510303771
Encrypted:	false
SSDEEP:	6:SlSWB9X5290Am2OHff4YPawmX/bVVFUFkCFVUP/GH6/XVVFUFkIZVVFUFkeF3k/g:MBp5290AmdHff4YPawY/b/uFkCFVUP/L
MD5:	5ACBD50E1CB87B4E7B735A8B5281917B
SHA1:	3E92C60B365C7E1F9BF5F312B007CBFD4175DB8F
SHA-256:	E61F3762B827971147772A01D51763A18CC5BED8F736000C64B4BDFF32973803
SHA-512:	9284FFDF115C7D7E548A06A6513E3591F88EE3E5197106B71B54CD82F27890D12773381218BCA69720F074A6762282F25830422DFA402FF19301D6834FD9FF7D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Blanc-Sablon) {. {-9223372036854775808 -13708 0 LMT}. {-2713896692 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {14400 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Boa_Vista

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	4.020601379816668
Encrypted:	false
SSDEEP:	24:cQETmexo6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9o:5Ea6SklVySklTpiSklo5Skl5oSklOsSs
MD5:	54138573741C384B92A8504C1A0D8EC2
SHA1:	BCA3C460ED0B2CB9E824186C768B15704EFB1739
SHA-256:	18DE58634803E9B6DFE5FC77B128E973FE3C93BC7C64648A2D7A9BCD20A3F7CB
SHA-512:	3E0ED239D4E5D58978C9F684E04E8B0AC2AFF55D2F75CB14051EDCDA358A3B1181C128BF82185B56C93E59B4C7CCCCD708AB876D83B306D3C0BB7A4BA6F3ECC4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boa_Vista) {. {-9223372036854775808 -14560 0 LMT}. {-1767211040 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\ProgramData\assignee\tcl\tzdata\America\Bogota

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.746762201325416
Encrypted:	false
SSDEEP:	6:SlSWB9X5290bJqm2OHDgPcuknTEXPkTkR/uF1xEV/kW:MBp5290bUmdHDgPcukT8kTY/uFo/kW
MD5:	97B0317C40277D2C05783482B02285F8
SHA1:	D62F23B775A29AC6A27C308F9EF09890B863DBA3
SHA-256:	26D171F53573B67D0A6260246A58289615A932B998194A9CDC80325998AC27E0
SHA-512:	636A34DC7074D551035F78A8150DFC05096AC7CF3CC9796D65F939DC9AE22A04DB22F14180A7B5B8E00E84E8FA621794B226C9F5BACD3E83B5D5AF24EAEE37FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bogota) {. {-9223372036854775808 -17776 0 LMT}. {-2707671824 -17776 0 BMT}. {-1739041424 -18000 0 COT}. {704869200 -14400 1 COST}. {733896000 -18000 0 COT}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Boise

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.772029913040983
Encrypted:	false
SSDEEP:	96:e45eG5cnWsGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:xGnWdVUC2mWBNwWTxyWR
MD5:	239425659E7345C757E6A44ABF258A22
SHA1:	9659217B4D55795333DFA5E08451B69D17F514AD
SHA-256:	6D6D377DDF237B1C5AB012DDDEB5F4FAA39D1D51240AA5C4C34EE96556D2D2F4
SHA-512:	3891D7BC1F84FF6B01B6C2DF6F0413C9E168E5B84CE445030F1B871766DD38B2FF7418501AB7C0DCEAB8381E538D65DF4E7708502EE924546A28DF1AC9BB7129
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boise) {. {-9223372036854775808 -27889 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-1471788000 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126255600 -25200 0 MST}. {129114000 -21600 0 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {2307

C:\ProgramData\assignee\tcl\tzdata\America\Buenos_Aires

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.775296176809929
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MQA+zJFVAIgp/MQA+z2L290BFzk5h490/MQA+zq:MBaIMY/MV+z6p/MV+z2L290rzy490/Mz
MD5:	861DAA3C2FFF1D3E9F81FB5C63EA71F1
SHA1:	8E219E63E6D7E702FD0644543E05778CE786601A
SHA-256:	1D32F22CF50C7586CB566E45988CA05538E61A05DF09FD8F824D870717832307
SHA-512:	71B47C369DF1958C560E71B114616B999FB4B091FAA6DD203B29D2555FFE419D6FC5EF82FA810DC56E6F00722E13B03BFBED2516B4C5C2321F21E03F0198B91B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Buenos_Aires)]} {. LoadTimeZoneFile America/Argentina/Buenos_Aires.}.set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires).

C:\ProgramData\assignee\tcl\tzdata\America\Cambridge_Bay

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7487
Entropy (8bit):	3.7913991050941216
Encrypted:	false
SSDEEP:	96:jGoGm+4ILQzXN+C2mWBNQMsmNTxf6AeO+cblX:+7YUC2mWBNwWTxyWR
MD5:	EA5C34D05D695102C33B25E919DDB4FB
SHA1:	1AE9BA64C31E9003D512612F6D18C8B506DB77B8
SHA-256:	631B1BE339315AAF7A800DC2C6754DADB8D95A9A6171277FE06E5D42C547DADF
SHA-512:	D888A87E1F3758B85EBDD47D9FD3A1E6EF85C190F8ACEEC73FD800B924B879BA40BFB23297C694B75E28F0BF46919582FF87DA9B6337FBEDEE58F4247936B8AC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cambridge_Bay) {. {-9223372036854775808 0 0 zzz}. {-1577923200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {

C:\ProgramData\assignee\tcl\tzdata\America\Campo_Grande

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7778
Entropy (8bit):	3.7685935760913543
Encrypted:	false
SSDEEP:	192:b1M1w141C1f1t1m1B121C1+1u181u1g1c1m181Q1b171M13191H1L1w151J/1Y1v:R0AI6tzW/m6O+k+wEWkgRx0FDVBAXJNS
MD5:	AC1DCB2B548972B024CDCFA3068EB01C
SHA1:	FE26175E34E34D061728C7F90253DDB5E56328C1
SHA-256:	4512035C9DF32640CA78C287B4CE8D188CC400B3CC841EF2B030FBD7A5558670
SHA-512:	92B3241F59238ACCDEE819E06DEE8CD99C7CB1019109870304789EC9EFA430636F4A0870E79599E3E8FF5A5984B2661D3BBC5D88FDC0A77A79FA28B5477DCE19
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Campo_Grande) {. {-9223372036854775808 -13108 0 LMT}. {-1767212492 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\ProgramData\assignee\tcl\tzdata\America\Cancun

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6435
Entropy (8bit):	3.7608837877562937
Encrypted:	false
SSDEEP:	192:GB+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmbwK:GB+z6stuNEsRZjWqZL/1dCYDDCxyH4RJ
MD5:	643DBC25906E245F5D6DB486A094B857
SHA1:	3B683B5C7A3E9A49F45076DCC0BFA48A2C0565EC
SHA-256:	8C7D8771386566B80325C0D19C964EA0F87CE244991DCDA2B0B2627EA9B0EAF5
SHA-512:	6CEEF8D8B4235CA0A67012DC40A5E1DF605075F1B3D5FE3E7D0CF70885459105A709DB43C71329A728DF5EA0125676F9A53AEF4EC449C404DA668837EECB8C1F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cancun) {. {-9223372036854775808 -20824 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {828860400 -14400 1 EDT}. {846396000 -18000 0 EST}. {860310000 -14400 1 EDT}. {877845600 -18000 0 EST}. {891759600 -14400 1 EDT}. {902041200 -18000 0 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD

C:\ProgramData\assignee\tcl\tzdata\America\Caracas

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.74219167348714
Encrypted:	false
SSDEEP:	6:SlSWB9X52909+ET2m2OHXP8Hk4lvFVFlRUF/R/PvWnVVFlK:MBp5290QmdHXPy/ltvQFZ/3qVvc
MD5:	31DF35E1C8C7F133CE6A8E1B4BA143E6
SHA1:	20C9F10CB35E700BD64C6337D0FE2CAACAAB3BE4
SHA-256:	909D1CB75BBE1C3FDBD5DD96FA1E03C16990602009CBACE875B8DF84A47FCA3F
SHA-512:	32A4D3F384233E12CD393119A762B50C7CA9720B74927BA6699891C288249DF7FA7ECD464DDB59B966B7E5F55A7B73F330661E13D1CE41E6FA8841C5B4FE5665
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Caracas) {. {-9223372036854775808 -16064 0 LMT}. {-2524505536 -16060 0 CMT}. {-1826739140 -16200 0 VET}. {-157750200 -14400 0 VET}. {1197183600 -16200 0 VET}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Catamarca

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.615632762186706
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs29094SXAFB5290/MMXAv:MBaIMY/Mhp/MP290mh5290/MH
MD5:	359226FA8A7EAFCA0851F658B4EBBCDC
SHA1:	611A24C24462DF5994B5D043E65770B778A6443B
SHA-256:	F2782781F1FB7FD12FF85D36BB244887D1C2AD52746456B3C3FEAC2A63EC2157
SHA-512:	6F9DD2D1662103EC5A34A8858BDFA69AC9F74D3337052AB47EA61DC4D76216886A0644CF1284940E8862A09CBA3E0A87784DFDB6414434C92E45004AAF312614
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca).

C:\ProgramData\assignee\tcl\tzdata\America\Cayenne

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.877199904694429
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE91pkXGm2OHEFvpoevUdR4FIUPveYKUwXvp3VVFVeYKn:SlSWB9X52909zm2OHEdGeG4v3w/ZVVFQ
MD5:	A755FF22FF28B7E23C7EB3A7AF02339A
SHA1:	16930549E0C2E913342256E40889A8A9DDE5D548
SHA-256:	9DB8D93A0D69ABB263D02D9FAC0A47F8CEAA7470E8FC2F47B62694BB1F0032A2
SHA-512:	7D4DEDCF3A606D233EFFF496D7FEE3604211C466540B3900C3D357186A4F0F28F3C63EFFF84C0A006FA97B64E5972FC5F2CD1B8C87BCD5FB639D7583635D2BAE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cayenne) {. {-9223372036854775808 -12560 0 LMT}. {-1846269040 -14400 0 GFT}. {-71092800 -10800 0 GFT}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Cayman

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.9217472988569995
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE91mWkXGm2OHDsoevX5XWXvFxYvFadINVVvain:SlSWB9X52909YCm2OHDsoeP5XA3GxNVZ
MD5:	C7EC198621FB438688F6F0F7ED8C759C
SHA1:	D4AECEA3E04292B860EB7AC67E067CE1B6682AEE
SHA-256:	ED9617961D23A77AFA3D131EE21017EDF1A01D83B5EECE22A67AB47EFE355A27
SHA-512:	0A0463D28205EA1D43AD8E9C7D460636629F3B8403CD166C255A61BC0622CAEDC629147DF0EEEBCC3EC21EA49F7DC3D460AC99FF1F0ABE567280CD82320EFD95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cayman) {. {-9223372036854775808 -19532 0 LMT}. {-2524502068 -18432 0 KMT}. {-1827687168 -18000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Chicago

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	3.728817385585057
Encrypted:	false
SSDEEP:	192:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzURWu3OabMQxXI6X8x3X3D2DgOMIOdXkqq:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzg
MD5:	6175956F3052F3BE172F6110EF6342EE
SHA1:	532E2600DFAFAACCD3A187A233956462383401A6
SHA-256:	FC172494A4943F8D1C3FC35362D96F3D12D6D352984B93BC1DE7BDCB7C85F15E
SHA-512:	36B47003183EB9D7886F9980538DB3BDDC231BB27D4F14006CDBE0CB9042215A02559D97085679F8320DED6109FC7745DC43859EBA99B87365B09C4526D28193
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chicago) {. {-9223372036854775808 -21036 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-1563724800 -18000 1 CDT}. {-1551632400 -21600 0 CST}. {-1538928000 -18000 1 CDT}. {-1520182800 -21600 0 CST}. {-1504454400 -18000 1 CDT}. {-1491757200 -21600 0 CST}. {-1473004800 -18000 1 CDT}. {-1459702800 -21600 0 CST}. {-1441555200 -18000 1 CDT}. {-1428253200 -21600 0 CST}. {-1410105600 -18000 1 CDT}. {-1396803600 -21600 0 CST}. {-1378656000 -18000 1 CDT}. {-1365354000 -21600 0 CST}. {-1347206400 -18000 1 CDT}. {-1333904400 -21600 0 CST}. {-1315152000 -18000 1 CDT}. {-1301850000 -21600 0 CST}. {-1283702400 -18000 1 CDT}. {-1270400400 -21600 0 CST}. {-1252252800 -18000 1 CDT}. {-1238950800 -21600 0 CST}. {-1220803200

C:\ProgramData\assignee\tcl\tzdata\America\Chihuahua

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6593
Entropy (8bit):	3.795313170000037
Encrypted:	false
SSDEEP:	96:LJNfzBT8tRkfKxhzY720zaOXmlITHjLc1cb:dN18tRkfKv+2wB9h
MD5:	B0CA4CFF6571AFBFF25FAC72CDDB5B08
SHA1:	1BF3ACEC369AEA504AAA248459A115E61CF79C4B
SHA-256:	C689A3BEED80D26EAB96C95C85874428F80699F7E136A44377776E52B5855D00
SHA-512:	398496EBA4344EDF78AFBF51BD6024481D3A12546D0EE597B7C593A1CD1BF575AFDE62FFADE7A0DDFEDA79CF235612E6F4DA74D7305A6E48F5942EA10D8A4F8E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chihuahua) {. {-9223372036854775808 -25460 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -25

C:\ProgramData\assignee\tcl\tzdata\America\Coral_Harbour

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.822360211437507
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/qlfSwFVAIgp/qlfAvt2909qEac90/qlfu:MBaIMY/TwQp/tvt290Fac90/j
MD5:	2541EC94D1EA371AB1361118EEC98CC6
SHA1:	950E460C1BB680B591BA3ADA0CAA73EF07C229FE
SHA-256:	50E6EE06C0218FF19D5679D539983CEB2349E5D25F67FD05E142921431DC63D6
SHA-512:	2E6B66815565A9422015CAB8E972314055DC4141B5C21B302ABD671F30D0FBAE1A206F3474409826B65C30EDBEDD46E92A99251AB6316D59B09FC5A8095E7562
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Atikokan)]} {. LoadTimeZoneFile America/Atikokan.}.set TZData(:America/Coral_Harbour) $TZData(:America/Atikokan).

C:\ProgramData\assignee\tcl\tzdata\America\Cordoba

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.74004515366486
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MdVAIgp/MOF29093+90/Msn:MBaIMY/M4p/MOF290c90/Ms
MD5:	89870B2001C2EE737755A692E7CA2F18
SHA1:	F67F6C22BF681C105068BEEB494A59B3809C5ED8
SHA-256:	38C3DD7DAF75DBF0179DBFC387CE7E64678232497AF0DACF35DC76050E9424F7
SHA-512:	EFA8A5A90BE6FAAA7C6F5F39CBBBA3C7D44C7943E1BB1B0F7E966FEE4F00F0E4BF1D999A377D4E5230271B120B059EB020BD93E7DA46CF1FFA54AB13D7EC3FFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba).

C:\ProgramData\assignee\tcl\tzdata\America\Costa_Rica

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.443696146912203
Encrypted:	false
SSDEEP:	12:MBp5290l0TmdHd5PZ6kibvI8/uFn/mSU/uFn/i/uFn/4Y8/uFn//DVn:cQmAed9Z6n5Sn/mtSn/iSn/4JSn/bh
MD5:	D47A1FBA5AD701E1CA168A356D0DA0A9
SHA1:	6738EA6B4F54CC76B9723917AA373034F6865AF1
SHA-256:	51F08C1671F07D21D69E2B7868AA5B9BDBFA6C31D57EB84EB5FF37A06002C5CD
SHA-512:	DB6AD81466500F22820941DF3369155BA03CFA42FA9D267984A28A6D15F88E1A71625E3DC578370B5F97727355EBB7C338482FA33A7701ADB85A160C09BAD232
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Costa_Rica) {. {-9223372036854775808 -20173 0 LMT}. {-2524501427 -20173 0 SJMT}. {-1545071027 -21600 0 CST}. {288770400 -18000 1 CDT}. {297234000 -21600 0 CST}. {320220000 -18000 1 CDT}. {328683600 -21600 0 CST}. {664264800 -18000 1 CDT}. {678344400 -21600 0 CST}. {695714400 -18000 1 CDT}. {700635600 -21600 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Creston

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.798554218839104
Encrypted:	false
SSDEEP:	6:SlSWB9X52909ovTm2OHpcHvvPagcyEXC/vHcQCi:MBp52900mdHpcHPagPECvHl
MD5:	9E3726148A53940507998FA1A5EEE6DB
SHA1:	2493B72DF895ED2AE91D09D43BDDADDB41E4DEBC
SHA-256:	E809F227E92542C6FB4BAC82E6079661EEF7700964079AA4D7E289B5B400EC49
SHA-512:	F5ED4085160A06DE672DB93CEE700C420D0438DE9AC3548B291DA236AA8CCC84F97270DA3956E49432AE1E281CCECEB6DF92E71EB305106655B4DF231E04B558
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Creston) {. {-9223372036854775808 -27964 0 LMT}. {-2713882436 -25200 0 MST}. {-1680454800 -28800 0 PST}. {-1627833600 -25200 0 MST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Cuiaba

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7771
Entropy (8bit):	3.7617088302190878
Encrypted:	false
SSDEEP:	192:H1M1w141C1f1t1m1B121C1+1u181u1g1c1m181Q1b171M13191H1L1w151i1M1Tc:V0AI6tzW/m6O+k+wEWkgRx0FDVBAXa04
MD5:	7ABE7E5CA88C79F45BB69CA5FFA31CE0
SHA1:	B8F114F908B63085053B21DFCB6E90FB904F5054
SHA-256:	5A64F2243FCC2CD7E691FFD45AC9ECA6BF0094ADAD2039A7F0D05D4CD79E2A6A
SHA-512:	853B7B36E772AD7F7A74BEE2D3A4422E6850A1EDC1181F0D9C13DCFA822812DEBD862FA1257B894F2445302D4E6DC7775952298FB9A66A739AF84195AD68FB4D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cuiaba) {. {-9223372036854775808 -13460 0 LMT}. {-1767212140 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}. {5

C:\ProgramData\assignee\tcl\tzdata\America\Curacao

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.902826505851901
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE9CvjEwcXGm2OHCevUd5xF9vFVFkEiQG3VFpRR/vwvYv:SlSWB9X52909C4wTm2OHjyxzF8WUF/RD
MD5:	BB167EA9048274395066008EEC00F0F6
SHA1:	E3BA9EB1A3DB110E55CAF53ED6C4AFC95CBDF54D
SHA-256:	1200BDE9BEFD7AD388ACF4C7AD7285CC72FF06454B281116BDB12F869C5EE205
SHA-512:	9A9AAE95295AD0E824D19E1069627972B63C143102379C79A0F46EDB8E22261AC338C4316A16F48F46F6DD0E856A73C3D476AEBDC3DD0F9F7AB0CD257D3F55E4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Curacao) {. {-9223372036854775808 -16547 0 LMT}. {-1826738653 -16200 0 ANT}. {-157750200 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Danmarkshavn

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1105
Entropy (8bit):	4.067921329211614
Encrypted:	false
SSDEEP:	24:cQZeXmTWP3n1/EOXT9vjwF97pWEEhcSXCLFg:5imTWPX1/pRvjwF97p3EbYFg
MD5:	A1B64D8D13A8588194BBE01118B336B8
SHA1:	FEFFFE122AAD6AC92383B93CEC33AEBE9CBAC048
SHA-256:	4CDA1CFD04480F2E75319AFD1F7E58319746169FF64A46F51AD03694E6FEC6D8
SHA-512:	24774A35CF7AC2182C2550F8ABCC4BA226352E4FFCA1EF09013A213BB219CC17BE201E0EB37C9695C2090CEEDDBB179FAB6AC44C52A7F26788D5B025AE84BE73
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Danmarkshavn) {. {-9223372036854775808 -4480 0 LMT}. {-1686091520 -10800 0 WGT}. {323845200 -7200 0 WGST}. {338950800 -10800 0 WGT}. {354675600 -7200 1 WGST}. {370400400 -10800 0 WGT}. {386125200 -7200 1 WGST}. {401850000 -10800 0 WGT}. {417574800 -7200 1 WGST}. {433299600 -10800 0 WGT}. {449024400 -7200 1 WGST}. {465354000 -10800 0 WGT}. {481078800 -7200 1 WGST}. {496803600 -10800 0 WGT}. {512528400 -7200 1 WGST}. {528253200 -10800 0 WGT}. {543978000 -7200 1 WGST}. {559702800 -10800 0 WGT}. {575427600 -7200 1 WGST}. {591152400 -10800 0 WGT}. {606877200 -7200 1 WGST}. {622602000 -10800 0 WGT}. {638326800 -7200 1 WGST}. {654656400 -10800 0 WGT}. {670381200 -7200 1 WGST}. {686106000 -10800 0 WGT}. {701830800 -7200 1 WGST}. {717555600 -10800 0 WGT}. {733280400 -7200 1 WGST}. {749005200 -10800 0 WGT}. {764730000 -7200 1 WGST}. {780

C:\ProgramData\assignee\tcl\tzdata\America\Dawson

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	3.785302701923574
Encrypted:	false
SSDEEP:	96:nxr+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:nx/Nf+aNwj/lpmlOxnKcndIG
MD5:	4DBA9C83ECAD5B5A099CC1AA78D391B0
SHA1:	FFCC77D7964BD16BD8A554FB437BCF4F2FC8958E
SHA-256:	3A89A6834DDBE4A3A6A1CB8C1A1F9579259E7FD6C6C55DE21DCD4807753D8E48
SHA-512:	21212AFE8917C0F3BBED433B510C4FCE671B0DA887A1C7338A18CD5409B1A95E766510A9E636E5AA3AB0BA21D7D2C00A462FEBB10D4567A343B85AFE6A3E2394
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson) {. {-9223372036854775808 -33460 0 LMT}. {-2188996940 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1 PDT}

C:\ProgramData\assignee\tcl\tzdata\America\Dawson_Creek

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	3.9458112723626755
Encrypted:	false
SSDEEP:	24:cQ4eJ58IlJ14RsT8X+km8VnynhBZ2c4Y+O4A5W5xDICW2n7oZA8QZFaIOvkty1H2:5DH0yIRkf12fZGJ5LB6xfZ89Y
MD5:	D7E4978775F290809B7C042674F46903
SHA1:	E94DB1EBB6A1594ED1A5AEA48B52395482D06085
SHA-256:	2E6CFFE8E0C1FE93F55B1BD01F96AA1F3CE645BC802C061CB4917318E30C4494
SHA-512:	1FF3CD58A4C4DEC7538F0816E93E6577C51B0045CF36190FF4D327E81FB8282ADDB0EF20BD78A838ABD507EBAD1C187F2A20CC7840E2325B9C326EC449897B45
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson_Creek) {. {-9223372036854775808 -28856 0 LMT}. {-2713881544 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-

C:\ProgramData\assignee\tcl\tzdata\America\Denver

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8629
Entropy (8bit):	3.76966035849006
Encrypted:	false
SSDEEP:	96:4cGbc2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:4c2dVUC2mWBNwWTxyWR
MD5:	F641A7F5DE8FCF4ADC1E5A1A2C9DEC53
SHA1:	B013EBBE8002C91C0C45A2D389245A1A9194077A
SHA-256:	DF5459068DB3C771E41BE8D62FB89A2822CB2A33CF9A5640C6C666AB20ECE608
SHA-512:	C2EA07FF21FD6D1A45A87C6AD85DD3929C2B56E66A52D23103DDFF7B2B3B6433EC5EBFC17BED0F9C0A9AF036F0DF965E12EA3D4463207A128AEF5F6BC12970D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Denver) {. {-9223372036854775808 -25196 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-1577898000 -25200 0 MST}. {-1570374000 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1538924400 -21600 1 MDT}. {-1534089600 -25200 0 MST}. {-883587600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-757357200 -25200 0 MST}. {-147884400 -21600 1 MDT}. {-131558400 -25200 0 MST}. {-116434800 -21600 1 MDT}. {-100108800 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200

C:\ProgramData\assignee\tcl\tzdata\America\Detroit

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8068
Entropy (8bit):	3.7425385734246395
Encrypted:	false
SSDEEP:	96:FVzAL/QaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:FVsLQrn+qvOTFhPI1jFIL
MD5:	7FE983DC88FDC4978CD0527052A5A5C8
SHA1:	DC9193B5BE70D1E36B595B94AF9FFCF0FBC2D3AF
SHA-256:	0FA6CF7F37C95E9E1FEA517057DCB9A9F31DE73C56865DB260CB9BB8C558E8D1
SHA-512:	825C8BA13359A214F2CF227A5A8DEF57FD34CFFAD824868C2CD82659C36611A43EE74C20BA683A6F18E7EF937F0A76C32F96E3FF812161F45AA59347E0BCFAD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Detroit) {. {-9223372036854775808 -19931 0 LMT}. {-2051202469 -21600 0 CST}. {-1724083200 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-757364400 -18000 0 EST}. {-684349200 -14400 1 EDT}. {-671047200 -18000 0 EST}. {-80499600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {94712400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {157784400 -18000 0 EST}. {167814000 -14400 0 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}.

C:\ProgramData\assignee\tcl\tzdata\America\Dominica

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.972086905253168
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE6ALoFSXGm2OHRvVvUdRR7FpRzVvwvYv:SlSWB9X5290TLoFJm2OHpVG/zVr
MD5:	4DD3CCF52F3868A20870D65C3E359743
SHA1:	A6B0A142BCE7D9202F8E9664CC90F09BBBF79D3B
SHA-256:	D396833B1D3B1FE44FFCF2FDEF72FDD8F029925E2414FDA17F81CD3E65DBD59F
SHA-512:	D94A916977F6808031CE33F549110D33440C5704FD4D70E4875C40BEA78E8142AB444D23DC1798E55145044DCD8EE4B89E834A5786CFD71EFC3483130FA0657C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dominica) {. {-9223372036854775808 -14736 0 LMT}. {-1846266804 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Edmonton

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8435
Entropy (8bit):	3.7724320820194475
Encrypted:	false
SSDEEP:	96:7tGVgeb0Gm+qI1zXN+C2mWBNQMsmNTxf6AeO+cblX:7heJ/UC2mWBNwWTxyWR
MD5:	FECBDD64036247B2FBB723ADD8F798F6
SHA1:	60B1719958AD6151CDB174A319A396D5F48C7CF1
SHA-256:	EC95041E0A97B37A60EF16A6FA2B6BCB1EBEFABBC9468B828D0F467595132BC2
SHA-512:	7CF94EC5040F4C8FA3C6ED30CFDAB59A199C18AA0CDA9A66D1A477F15563D2B7CB872CEEF1E2295E0F3B9A85508A03AEC29E3ECEBE11D9B089A92794D510BA00
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Edmonton) {. {-9223372036854775808 -27232 0 LMT}. {-1998663968 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1600614000 -21600 1 MDT}. {-1596816000 -25200 0 MST}. {-1567954800 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1536505200 -21600 1 MDT}. {-1523203200 -25200 0 MST}. {-1504450800 -21600 1 MDT}. {-1491753600 -25200 0 MST}. {-1473001200 -21600 1 MDT}. {-1459699200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {136371600 -21600 1 MDT}. {152092800 -25200 0 MST}. {167821200 -21600 1 MDT}. {183542400

C:\ProgramData\assignee\tcl\tzdata\America\Eirunepe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1174
Entropy (8bit):	4.014131030146366
Encrypted:	false
SSDEEP:	24:cQOX9eptVwss/uS+L/ux+y/up+a/uj+Ne/ud+Rs/uX4+G/u43+a/uo8+h/u1F+El:5OXUCsQt8uqwd4rghFGRhGj+tX1R+fGO
MD5:	FEE5FD878B250DDDF0CEC30F6F6A7C3C
SHA1:	ED94E9DC9A246FD1FFCA817FC0B18A8B2945E371
SHA-256:	DA1F3923B9C7EFBFBCDF169C9E6E8F184695F2FD919FD04733EE05BB9FD7FC6E
SHA-512:	7187D385BB88590F46802307BE17D90F612DD8B1646C9B28E8115B5DC4AA909EFCB0B29438C7F65C6D6C18B79F285636F1578C4FED3D95A33B78225549118036
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Eirunepe) {. {-9223372036854775808 -16768 0 LMT}. {-1767208832 -18000 0 ACT}. {-1206950400 -14400 1 ACST}. {-1191355200 -18000 0 ACT}. {-1175367600 -14400 1 ACST}. {-1159819200 -18000 0 ACT}. {-633812400 -14400 1 ACST}. {-622062000 -18000 0 ACT}. {-602276400 -14400 1 ACST}. {-591825600 -18000 0 ACT}. {-570740400 -14400 1 ACST}. {-560203200 -18000 0 ACT}. {-539118000 -14400 1 ACST}. {-531345600 -18000 0 ACT}. {-191358000 -14400 1 ACST}. {-184190400 -18000 0 ACT}. {-155156400 -14400 1 ACST}. {-150062400 -18000 0 ACT}. {-128890800 -14400 1 ACST}. {-121118400 -18000 0 ACT}. {-99946800 -14400 1 ACST}. {-89582400 -18000 0 ACT}. {-68410800 -14400 1 ACST}. {-57960000 -18000 0 ACT}. {499755600 -14400 1 ACST}. {511243200 -18000 0 ACT}. {530600400 -14400 1 ACST}. {540273600 -18000 0 ACT}. {562136400 -14400 1 ACST}. {571204800 -18000 0 ACT}.

C:\ProgramData\assignee\tcl\tzdata\America\El_Salvador

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.7060952459188305
Encrypted:	false
SSDEEP:	6:SlSWB9X529078iwTm2OHvJ4YRIgdrV/uFn/acD3/uFn/sVn:MBp5290785mdHx4YlB/uFn/z/uFn/U
MD5:	77BE2E0759A3B7227B4DAC601A670D03
SHA1:	1FB09211F291E5B1C5CC9848EB53106AF48EE830
SHA-256:	40994535FE02326EA9E373F54CB60804BA7AE7162B52EA5F73497E7F72F2D482
SHA-512:	EB5E6A4A912053E399F6225A02DDC524A223D4A5724165CAD9009F1FA10B042F971E52CE17B395A86BC80FCC6897FD2CCC3B00708506FEF39E4D71812F5DF595
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/El_Salvador) {. {-9223372036854775808 -21408 0 LMT}. {-1546279392 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Ensenada

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.786739478919165
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo2IAcGE7JM7QIAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo2907390eu
MD5:	74AB4664E80A145D808CAB004A22859B
SHA1:	2AF7665C4E155A227B3F76D1C4BC87854C25A6CB
SHA-256:	BDD0893AA5D170F388B1E93CE5FE2EDF438866707E52033E49898AFC499F86C5
SHA-512:	CCC2E75E07BA1CAAFD1149A22D07668D191594272922AA2A1CE6DE628A8FF49AD90AA8BFE75C005328820C700B991AD87A6F40DEB5AD519B2708D8F7BF04E5A0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:America/Ensenada) $TZData(:America/Tijuana).

C:\ProgramData\assignee\tcl\tzdata\America\Fort_Wayne

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.730673843485836
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL290HXYAp4903GK1:MBaIMY3GK7Hp3GKBL290Hz4903GK1
MD5:	4685E4E850E0B6669F72B8E1B4314A0A
SHA1:	BC6CCD58A2977A1E125B21D7B8FD57E800E624E1
SHA-256:	D35F335D6F575F95CEA4FF53382C0BE0BE94BE7EB8B1E0CA3B7C50E8F7614E4E
SHA-512:	867003B33A5FC6E42D546FBFC7A8AB351DE72232B89BA1BEC6DB566F6DCE135E65C08DE9112837190EB21D677E2F83E7E0F6049EC70CB9E36F223DE3A68E000A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis).

C:\ProgramData\assignee\tcl\tzdata\America\Fortaleza

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	3.9968678665202413
Encrypted:	false
SSDEEP:	24:cQVe5qc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+evIG+M+w+w+jZ+SIrX5:5WP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wo
MD5:	FC299CE2BCD4303BC0F5600111428585
SHA1:	D08B49D8B5E983765F4D3D24359E1896177F7429
SHA-256:	1272363FC2F2AC38F10ED82E0869B2250BA9A29136BBE8EBEF3727CDE4EBF937
SHA-512:	DE2CC7D3EAF987F775437995EEBE663DA0DF952838B701EC15E67BC098337580948983805A00BAEA9E95420C63F53A7443B2F813B67ECAE2C9D86E604946321F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fortaleza) {. {-9223372036854775808 -9240 0 LMT}. {-1767216360 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -72

C:\ProgramData\assignee\tcl\tzdata\America\Glace_Bay

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8099
Entropy (8bit):	3.737123408653655
Encrypted:	false
SSDEEP:	192:C1V2eXXnqvlrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kQ:CDJv
MD5:	3A839112950BFDFD3B5FBD440A2981E4
SHA1:	FFDF034F7E26647D1C18C1F6C49C776AD5BA93ED
SHA-256:	3D0325012AB7076FB31A68E33EE0EABC8556DFA78FBA16A3E41F986D523858FF
SHA-512:	1E06F4F607252C235D2D69E027D7E0510027D8DB0EE49CF291C39D6FD010868EF6899437057DA489DD30981949243DDFA6599FD07CE80E05A1994147B78A76CE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Glace_Bay) {. {-9223372036854775808 -14388 0 LMT}. {-2131646412 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-536443200 -14400 0 AST}. {-526500000 -10800 1 ADT}. {-513198000 -14400 0 AST}. {-504907200 -14400 0 AST}. {63086400 -14400 0 AST}. {73461600 -10800 1 ADT}. {89182800 -14400 0 AST}. {104911200 -10800 1 ADT}. {120632400 -14400 0 AST}. {126244800 -14400 0 AST}. {136360800 -10800 1 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}.

C:\ProgramData\assignee\tcl\tzdata\America\Godthab

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7306
Entropy (8bit):	3.7801111303444968
Encrypted:	false
SSDEEP:	192:zT8l/pRvjwr7p3EbYFKTqoQThBEIfwjocaBhlxJo9udei+P3+/c+qQqarjlZjWuz:fzRLBuvfxhk
MD5:	9DA154CF3D02ABE7BF2656D686FB0009
SHA1:	077CEF531C4176A24C798FD6B132CDFA388F8506
SHA-256:	8D5576049B0B621DB2A112002CD34F38295FA7DB63BACFB462F3A59933491299
SHA-512:	CDAD3B6EC3C3378819BE52117AFA4605C0973555267CBFC97BDFC14A876C964CEA354A0BC8FB1311521046FFCC8842E299004B93794707575AD0A864F8F42E70
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Godthab) {. {-9223372036854775808 -12416 0 LMT}. {-1686083584 -10800 0 WGT}. {323845200 -7200 0 WGST}. {338950800 -10800 0 WGT}. {354675600 -7200 1 WGST}. {370400400 -10800 0 WGT}. {386125200 -7200 1 WGST}. {401850000 -10800 0 WGT}. {417574800 -7200 1 WGST}. {433299600 -10800 0 WGT}. {449024400 -7200 1 WGST}. {465354000 -10800 0 WGT}. {481078800 -7200 1 WGST}. {496803600 -10800 0 WGT}. {512528400 -7200 1 WGST}. {528253200 -10800 0 WGT}. {543978000 -7200 1 WGST}. {559702800 -10800 0 WGT}. {575427600 -7200 1 WGST}. {591152400 -10800 0 WGT}. {606877200 -7200 1 WGST}. {622602000 -10800 0 WGT}. {638326800 -7200 1 WGST}. {654656400 -10800 0 WGT}. {670381200 -7200 1 WGST}. {686106000 -10800 0 WGT}. {701830800 -7200 1 WGST}. {717555600 -10800 0 WGT}. {733280400 -7200 1 WGST}. {749005200 -10800 0 WGT}. {764730000 -7200 1 WGST}. {7804548

C:\ProgramData\assignee\tcl\tzdata\America\Goose_Bay

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10015
Entropy (8bit):	3.780383775128893
Encrypted:	false
SSDEEP:	192:z9zdvd8mSGDcfnrpbXXMqvlrPGgFEUlpd8ESeYPiVFuT/eleWmBk81kS/kV6kefD:z9zdvd7SGgcESeYPiV2Jv
MD5:	77DEEF08876F92042F71E1DEFA666857
SHA1:	7E21B51B3ED8EBEB85193374174C6E2BCA7FEB7F
SHA-256:	87E9C6E265BFA58885FBEC128263D5E5D86CC32B8FFEDECAFE96F773192C18BE
SHA-512:	C9AB8C9147354A388AEC5FE04C6C5317481478A07893461706CDC9FD5B42E31733EAC01C95C357F3C5DC3556C49F20374F58A6E0A120755D5E96744DE3A95A81
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Goose_Bay) {. {-9223372036854775808 -14500 0 LMT}. {-2713895900 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1096921748 -12600 0 NST}. {-1072989000 -12600 0 NST}. {-1061670600 -9000 1 NDT}. {-1048973400 -12600 0 NST}. {-1030221000 -9000 1 NDT}. {-1017523800 -12600 0 NST}. {-998771400 -9000 1 NDT}. {-986074200 -12600 0 NST}. {-966717000 -9000 1 NDT}. {-954624600 -12600 0 NST}. {-935267400 -9000 1 NDT}. {-922570200 -12600 0 NST}. {-903817800 -9000 1 NDT}. {-891120600 -12600 0 NST}. {-872368200 -9000 0 NWT}. {-769395600 -9000 1 NPT}. {-765401400 -12600 0 NST}. {-757369800 -12600 0 NST}. {-746044200 -9000 1 NDT}. {-733347000 -12600 0 NST}. {-714594600 -9000 1 NDT}. {-701897400 -12600 0 NST}. {-683145000 -9000 1 NDT}. {-670447800 -12600 0 NST}. {-6516954

C:\ProgramData\assignee\tcl\tzdata\America\Grand_Turk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7398
Entropy (8bit):	3.7539771468431327
Encrypted:	false
SSDEEP:	96:hfaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:hfrn+qvOTFhPI1jFIL
MD5:	E31A9245677089B667116925548F8EA4
SHA1:	FA077C3A47201161D422E8B1F39CF914EE49EB68
SHA-256:	FF2A5E8CC94B425F1E96F3E11AE462D3D69B055DB95C3C0F706A1E468A830573
SHA-512:	50F288D3D2D1ADA1776ACC724971B0583738B906F38C27E3E241A760C11396840FCA6A7F130DCF6D553F5CAF9395CD13D2D2A469E6F65DD3DE012EF7E20AF827
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Grand_Turk) {. {-9223372036854775808 -17072 0 LMT}. {-2524504528 -18432 0 KMT}. {-1827687168 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {719992800 -18000 0 EST}. {73

C:\ProgramData\assignee\tcl\tzdata\America\Grenada

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.9628318832469
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE5QFEXGm2OHtvUdRedVFpPvwvYv:SlSWB9X52905QFLm2OHtGedvpPr
MD5:	5DB4BA5A2D563738350CEC6D96D24942
SHA1:	6DBE2EF9A4C37F96C81A9F4A2A435C79F21AB67D
SHA-256:	405B6F5D432686CE124A52385A6D10F68FEFF483764FF5300BFB4052986EAA7D
SHA-512:	8B1205E4395004A3569482B3328CF04E3BA4144DFFAF1DF4AAED6E3377D41B7AEB5F1372AA00DD9B9E9BD8A80ACC1E91ACD2A6EDB689A54CE8C0ACAA810A0532
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Grenada) {. {-9223372036854775808 -14820 0 LMT}. {-1846266780 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Guadeloupe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.0105116034458
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE5AJLkHkXGm2OHwV4YvUdV5vwvYv:SlSWB9X52905AJLkLm2OHfY+r
MD5:	675B8B4CEEDE88EB4572050B2A21907B
SHA1:	E8A8AB8329DE57E136EC4202898FC791EE18D427
SHA-256:	6B83925B5B259D4D370EBB72D302735D57D0FF5A03A03C00E5EB939CECDC992F
SHA-512:	FA52EED3A75EA3EBAB444D5CE3237C8E60F6F474325253667BF0E8F0EDF8E78D91BBF897884BAC63CAE4CE21BA1FF561E1D1F4C3DAC20047579C12BEA4C410C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guadeloupe) {. {-9223372036854775808 -14768 0 LMT}. {-1848254032 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Guatemala

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.450029420195016
Encrypted:	false
SSDEEP:	12:MBp52906GdJmdHKznI2f/uFn/z/uFn/w67Rd3/uFn/4Bx/uFn/xAQ:cQ8JeQXfSn/zSn/w67Rd3Sn/4HSn/j
MD5:	6E3FD9D19E0CD26275B0F95412F13F4C
SHA1:	A1B6D6219DEBDBC9B5FFF5848E5DF14F8F4B1158
SHA-256:	1DC103227CA0EDEEBA8EE8A41AE54B3E11459E4239DC051B0694CF7DF3636F1A
SHA-512:	BF615D16BB55186AFC7216B47250EE84B7834FD08077E29E0A8F49C65AACAAD8D27539EA751202EBFF5E0B00702EC59B0A7D95F5FB585BFED68AC6206416110D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guatemala) {. {-9223372036854775808 -21724 0 LMT}. {-1617040676 -21600 0 CST}. {123055200 -18000 1 CDT}. {130914000 -21600 0 CST}. {422344800 -18000 1 CDT}. {433054800 -21600 0 CST}. {669708000 -18000 1 CDT}. {684219600 -21600 0 CST}. {1146376800 -18000 1 CDT}. {1159678800 -21600 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Guayaquil

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.957616449865346
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE5qJkXGm2OHHjGevX5lH6owsXSicUTpvaPAv:SlSWB9X529056m2OHHjGeP5lahicKpiS
MD5:	2E9AE527CE849A35219EF68F3BECA3AD
SHA1:	6C3D12907122383FED9C6F65D3F38E7D1CE43761
SHA-256:	D9AB34DF36DF3AADA024B093E8F73EAE43B4B56CAF8EFB00D82A518E44979C66
SHA-512:	540DE179EE5D716537C3E7C184CD098A281D59D285A4E5E7733AC28A0F17F644E7F192EFD76DE5D7EEB80D91754D8B2579DCDDC49296AF433CEA10A5EE405F5F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guayaquil) {. {-9223372036854775808 -19160 0 LMT}. {-2524502440 -18840 0 QMT}. {-1230749160 -18000 0 ECT}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Guyana

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.722702793311002
Encrypted:	false
SSDEEP:	6:SlSWB9X52905R3Lm2OHRjGeTShVy4YiwNUSY6KcVVFLIB/z:MBp5290LLmdHVTiy45NSOc/VG/z
MD5:	8D1F3433552E24E8C97DDE88DFCC070F
SHA1:	992FBE19E858ADDBF228D1FFCF3E2A8ED860CEE0
SHA-256:	619CE2809A31BF685A74F0D54E9433A5557796C73B9337CAB7CC19980352DBAF
SHA-512:	89A80E8744117131854BD65F21F5FDF4BA22C215DD99C0DAD5144F0D01D3C19160085E28293682EF8FEDA8AE244FDA8BA3E3199D233D9B7EAAD4EC6D8A73BBAE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guyana) {. {-9223372036854775808 -13960 0 LMT}. {-1730578040 -13500 0 GBGT}. {-113688900 -13500 0 GYT}. {176010300 -10800 0 GYT}. {662698800 -14400 0 GYT}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Halifax

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10763
Entropy (8bit):	3.724988391778253
Encrypted:	false
SSDEEP:	192:Y7Z1hubfVmv0SqJXDiFHrbm96qddObEn/RDzWRfQFQ4XL8vG+81VcfnrpbXXnqvo:823ZLYvuOZJv
MD5:	7DE8E355A725B3D9B3FD06A838B9715F
SHA1:	41C6AAEA03FC7FEED50CFFFC4DFF7F35E2B1C23D
SHA-256:	5F65F38FFA6B05C59B21DB98672EB2124E4283530ACB01B22093EAEFB256D116
SHA-512:	4C61A15DDF28124343C1E6EFE068D15E48F0662534486EC38A4E2731BE085CDA5856F884521EF32A6E0EDD610A8A491A722220BDD1BAF2A9652D8457778AF696
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Halifax) {. {-9223372036854775808 -15264 0 LMT}. {-2131645536 -14400 0 AST}. {-1696276800 -10800 1 ADT}. {-1680469200 -14400 0 AST}. {-1640980800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1609444800 -14400 0 AST}. {-1566763200 -10800 1 ADT}. {-1557090000 -14400 0 AST}. {-1535486400 -10800 1 ADT}. {-1524949200 -14400 0 AST}. {-1504468800 -10800 1 ADT}. {-1493413200 -14400 0 AST}. {-1472414400 -10800 1 ADT}. {-1461963600 -14400 0 AST}. {-1440964800 -10800 1 ADT}. {-1429390800 -14400 0 AST}. {-1409515200 -10800 1 ADT}. {-1396731600 -14400 0 AST}. {-1376856000 -10800 1 ADT}. {-1366491600 -14400 0 AST}. {-1346616000 -10800 1 ADT}. {-1333832400 -14400 0 AST}. {-1313956800 -10800 1 ADT}. {-1303678800 -14400 0 AST}. {-1282507200 -10800 1 ADT}. {-1272661200 -14400 0 AST}. {-1251057600 -10800 1 ADT}. {-1240088400

C:\ProgramData\assignee\tcl\tzdata\America\Havana

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.7376582182649556
Encrypted:	false
SSDEEP:	192:VXA0Bc0tTJtNliQ4sxgpuG4c2JPTxUw9Or2ocrPGSyM9Gk4LK4ZMCf7VkXgySCWv:VXA0Bc0tTJtNliQ4sxSuG4c2JPTxUw9m
MD5:	74572530B8D6D99B6FA3FAFB80B1BD54
SHA1:	282F7FB8D70D73B6DB7820982715B3BCC4204831
SHA-256:	1D901D6383B076987519457BB3FEBF284E777E5ECFE940B4E81FC318C86D87B6
SHA-512:	7DE0F5924818399BD90FC123DB1ED3DB68E716CF95021C87A7D07D8CF48D8C7362F8CC5F236B4EA184F58B35D77BEAD0CB69B8077DD73CA02F504C5EB31A074E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Havana) {. {-9223372036854775808 -19768 0 LMT}. {-2524501832 -19776 0 HMT}. {-1402813824 -18000 0 CST}. {-1311534000 -14400 1 CDT}. {-1300996800 -18000 0 CST}. {-933534000 -14400 1 CDT}. {-925675200 -18000 0 CST}. {-902084400 -14400 1 CDT}. {-893620800 -18000 0 CST}. {-870030000 -14400 1 CDT}. {-862171200 -18000 0 CST}. {-775681200 -14400 1 CDT}. {-767822400 -18000 0 CST}. {-744231600 -14400 1 CDT}. {-736372800 -18000 0 CST}. {-144702000 -14400 1 CDT}. {-134251200 -18000 0 CST}. {-113425200 -14400 1 CDT}. {-102542400 -18000 0 CST}. {-86295600 -14400 1 CDT}. {-72907200 -18000 0 CST}. {-54154800 -14400 1 CDT}. {-41457600 -18000 0 CST}. {-21495600 -14400 1 CDT}. {-5774400 -18000 0 CST}. {9954000 -14400 1 CDT}. {25675200 -18000 0 CST}. {41403600 -14400 1 CDT}. {57729600 -18000 0 CST}. {73458000 -14400 1 CDT}. {87364800 -18000 0 CST}.

C:\ProgramData\assignee\tcl\tzdata\America\Hermosillo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.2803367804689785
Encrypted:	false
SSDEEP:	12:MBp5290ebmdH5NWw+Ux++vTQtFlvm0tFXtFjV5a:cQBe5gfUT7UFltF9FjV5a
MD5:	9D1A1746614CE2CEE26D066182938CDC
SHA1:	967590403A84E80ED299B8D548A2B37C8EEB21CE
SHA-256:	493DB3E7B56B2E6B266A5C212CD1F75F1E5CF57533DA03BB1C1F2449543B9F48
SHA-512:	DFAE6BC48F2E4B75DD6744AEE57D31D6A6E764D02DCA5731C7B516AD87B9BAB2FEB355A012EC38BDD53008B501B0744953EB7E0677F02B9EAF083D2E66042B37
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Hermosillo) {. {-9223372036854775808 -26632 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {915174000 -25200 0 MST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Indianapolis

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6996
Entropy (8bit):	3.799188069575817
Encrypted:	false
SSDEEP:	96:uRXxWMzJ2eQzURWu3N7sHRwvOTFhP5S+ijFnRaJeaX1eyDt:uRXxWUJ2eQzURWu3NOqvOTFhPI1jFIL
MD5:	154A332C3ACF6D6F358B07D96B91EBD1
SHA1:	FC16E7CBE179B3AB4E0C2A61AB5E0E8C23E50D50
SHA-256:	C0C7964EBF9EA332B46D8B928B52FDE2ED15ED2B25EC664ACD33DA7BF3F987AE
SHA-512:	5831905E1E6C6FA9DD309104B3A2EE476941D6FF159764123A477E2690C697B0F19EDEA0AD0CD3BBBECF96D64DC4B981027439E7865FCB1632661C8539B3BD6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Indianapolis) {. {-9223372036854775808 -20678 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-900259200 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Knox

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8470
Entropy (8bit):	3.7546412701514034
Encrypted:	false
SSDEEP:	192:AXxr2eQzURWu3Oab9BxXI6X8xYIIOdXkqbfkeTzZSJw5/9/yuvQ+hcr8bYkzbXw6:AXxr2eQzUwu3Oab9BxXI6XUYIIOdXkqv
MD5:	E8AFD9E320A7F4310B413F8086462F31
SHA1:	7BEE624AAC096E9C280B4FC84B0671381C657F6C
SHA-256:	BE74C1765317898834A18617352DF3B2952D69DE4E294616F1554AB95824DAF0
SHA-512:	C76620999A293FA3A93CA4615AB78F19395F12CC08C242F56BFD4C4CAF8BC769DDEBF33FF10F7DA5A3EFD8ED18792362780188636075419014A8C099A897C43C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Knox) {. {-9223372036854775808 -20790 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-725824800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-415818000 -21600 0 CST}.

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Marengo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7037
Entropy (8bit):	3.786429098558221
Encrypted:	false
SSDEEP:	96:FXx3knO559B18XWRh0ksHRwvOTFhP5S+ijFnRaJeaX1eyDt:FXxUnO559B2XWRh0pqvOTFhPI1jFIL
MD5:	456422A0D5BE8FBF5DBD0E75D8650894
SHA1:	737AC21F019A7E89689B9C8B465C8482FF4F403E
SHA-256:	C92D86CACFF85344453E1AFBC124CE11085DE7F6DC52CB4CBE6B89B01D5FE2F3
SHA-512:	372AEBB2F13A50536C36A025881874E5EE3162F0168B71B2083965BECBBFCA3DAC726117D205D708CC2B4F7ABE65CCC2B3FE6625F1403D97001950524D545470
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Marengo) {. {-9223372036854775808 -20723 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-599594400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Petersburg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7364
Entropy (8bit):	3.79636789874872
Encrypted:	false
SSDEEP:	192:pXxS559B2XW6X8x3X3D2D8IOdXkqbfkeTzlbaqvOTFhPI1jFIL:pXxS559B2XW6XU3X3D2D8IOdXkqbfNT2
MD5:	9614153F9471187A2F92B674733369A0
SHA1:	199E8D5018A374EDB9592483CE4DDB30712006E3
SHA-256:	5323EBC8D450CC1B53AED18AD209ADEB3A6EEB5A00A80D63E26DB1C85B6476ED
SHA-512:	2A1E26D711F62C51A5EE7014584FAF41C1780BD62573247D45D467500C6AB9A9EAD5A382A1986A9D768D7BB927E4D391EA1B7A4AD9A54D3B05D8AD2385156C33
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Petersburg) {. {-9223372036854775808 -20947 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-473364000 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-257965200 -21600 0 CST}. {-242236800 -18000 1 CDT}. {-226515600 -21600 0 CST}. {-210787200 -18000 1 CDT}. {-195066000 -21600 0 CST}. {-179337600 -18000 1 CDT}. {-163616400 -21600 0 CST

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Tell_City

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	3.7768650637181533
Encrypted:	false
SSDEEP:	192:CXxjL36559B2XI6XE3X3D2E0bYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3g:CXxjL36559B2XI6XE3X3D2E0bYkzbXw6
MD5:	D0F40504B578D996E93DAE6DA583116A
SHA1:	4D4D24021B826BFED2735D42A46EEC1C9EBEA8E3
SHA-256:	F4A0572288D2073D093A256984A2EFEC6DF585642EA1C4A2860B38341D376BD8
SHA-512:	BA9D994147318FF5A53D45EC432E118B5F349207D58448D568E0DB316452EF9FD620EE4623FD4EAD123BC2A6724E1BAE2809919C58223E6FD4C7A20F004155E0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Tell_City) {. {-9223372036854775808 -20823 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Vevay

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6350
Entropy (8bit):	3.782861360101505
Encrypted:	false
SSDEEP:	96:K9Xx3+lsHRwvOTFhP5S+ijFnRaJeaX1eyDt:6XxuoqvOTFhPI1jFIL
MD5:	35A64C161E0083DCE8CD1E8E1D6EBE85
SHA1:	9BC295C23783C07587D82DA2CC25C1A4586284B2
SHA-256:	75E89796C6FB41D75D4DDA6D94E4D27979B0572487582DC980575AF6656A7822
SHA-512:	7BAF735DA0DE899653F60EED6EEF53DD8A1ABC6F61F052B8E37B404BC9B37355E94563827BC296D8E980C4247864A57A117B7B1CB58A2C242991BBDC8FE7174E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vevay) {. {-9223372036854775808 -20416 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-495043200 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {1136091600 -18000 0 EST}. {1143961200 -14400 1 EDT}. {1162101600 -18000 0 EST}. {1173596400 -14400 1 EDT}. {1194156000 -18000 0 EST}. {1205046000 -14400 1 EDT}. {1225605600 -18000 0 EST}. {1236495600 -14400 1 EDT}. {1257055200 -18000 0 EST}. {1268550000 -14400 1 EDT}. {1289109600 -18000

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Vincennes

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	3.795913753683276
Encrypted:	false
SSDEEP:	192:TXxjL36559B2XI6XE3X3D2E0baqvOTFhPI1jFIL:TXxjL36559B2XI6XE3X3D2E0bZ3+
MD5:	AD8B44BD0DBBEB06786B2B281736A82B
SHA1:	7480D3916F0ED66379FC534F20DC31001A3F14AF
SHA-256:	18F35F24AEF9A937CD9E91E723F611BC5D802567A03C5484FAB7AEEC1F2A0ED0
SHA-512:	7911EC3F1FD564C50DEAF074ED99A502A9B5262B63E3E0D2901E21F27E90FBD5656A53831E61B43A096BA1FF18BB4183CCCE2B903782C2189DAAFDD7A90B3083
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vincennes) {. {-9223372036854775808 -21007 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}

C:\ProgramData\assignee\tcl\tzdata\America\Indiana\Winamac

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7170
Entropy (8bit):	3.7942292979267767
Encrypted:	false
SSDEEP:	192:YXxjJ2eQzURWu3Oab9B2XWR0/qvOTFhPI1jFIL:YXxjJ2eQzUwu3Oab9B2XWR0M3+
MD5:	40D8E05D8794C9D11DF018E3C8B8D7C0
SHA1:	58161F320CB46EC72B9AA6BAD9086F18B2E0141B
SHA-256:	A13D6158CCD4283FE94389FD341853AD90EA4EC505D37CE23BD7A6E7740F03F6
SHA-512:	BC45B6EFF1B879B01F517D4A4012D0AFBA0F6A9D92E862EF9A960FE07CBE216C8C929FE790044C566DC95981EC4BEAB3DCBD45A1FE597606CF601214A78AEA08
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Winamac) {. {-9223372036854775808 -20785 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}.

C:\ProgramData\assignee\tcl\tzdata\America\Indianapolis

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.655121947675421
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL2903GfJ4903GK1:MBaIMY3GK7Hp3GKBL2903GfJ4903GK1
MD5:	CB79BE371FAB0B0A5EBEB1BA101AA8BA
SHA1:	6A24348AB24D6D55A8ABDEE1500ED03D5D1357F3
SHA-256:	6AABF28AC5A766828DD91F2EE2783F50E9C6C6307D8942FCD4DFAE21DB2F1855
SHA-512:	156E1E7046D7A0938FE4BF40BC586F0A7BEF1B0ED7B887665E9C6041980B511F079AA739B7BD42A89794CB9E82DB6629E81DD39D2F8161DFABDED539E272FB6E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis).

C:\ProgramData\assignee\tcl\tzdata\America\Inuvik

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7389
Entropy (8bit):	3.78271920608107
Encrypted:	false
SSDEEP:	96:/YGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:/JVUC2mWBNwWTxyWR
MD5:	EA93F2A5DE3CED689C8A9664E31D9174
SHA1:	EF81F6A41767084F8C8DC629E0C084C947DA3E2A
SHA-256:	8892A520B306C18A55B2114E1EC9514263F818801D8A0C3A9B8C6E4345B73A0E
SHA-512:	5A237535A8C875D9E734D4A37DA3DB1B1ED86DB407E9E741E1EF241697B9314BA6A3C934227B6D776168C324EC1EE3C939DF1BEB2540342A502AA78DB0E97020
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Inuvik) {. {-9223372036854775808 0 0 zzz}. {-536457600 -28800 0 PST}. {-147888000 -21600 1 PDDT}. {-131558400 -28800 0 PST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {702464400 -21600 1 MDT}. {720000000 -25200 0 MST}. {733914000 -

C:\ProgramData\assignee\tcl\tzdata\America\Iqaluit

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7421
Entropy (8bit):	3.7514030267117118
Encrypted:	false
SSDEEP:	96:b/GC3XmzdsHRwvOTFhP5S+ijFnRaJeaX1eyDt:b/Pn0gqvOTFhPI1jFIL
MD5:	A9A59966C4F90AEE45E5DBE2FAFD6ACF
SHA1:	FFFE0614CFEE9477311943211DA6A8988E7381F1
SHA-256:	356CA4C5D302EB72566254E58CE6570C45EB1399C8CC2B4CE0369778B10E9329
SHA-512:	FD62119A86EEC7CFFF0F9179BF7C4DFD0BC4A6CF46D79349821DEFECB4E0FD20DAECBE7F038B0EA1694DADA8F0087E2AFC0E4D6F81DFF26586719FEEC9E461F0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Iqaluit) {. {-9223372036854775808 0 0 zzz}. {-865296000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-147898800 -10800 1 EDDT}. {-131569200 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71999280

C:\ProgramData\assignee\tcl\tzdata\America\Jamaica

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	4.1553379694786745
Encrypted:	false
SSDEEP:	24:cQ1eiL0/XIp/uJD/u2lR/utzN54i/uhU/ufUF5/uDBq/u63gU/u3Zh/u4u8H:5/CIgxmzfwuFqBG3g/k8H
MD5:	FB678391730740C7E72C276568728694
SHA1:	6E34D42DADD1923C4B27D8404A83B66798B344E6
SHA-256:	D073E0961CFE467EBD2AE0D3D52C300663C187F483B32851FFF8F6F5B3A16BA9
SHA-512:	64469508633E96228C20A06221B45651923CB6FFBBCC6B9534B4609757483A2D8E1F2B81929D444DA24345D01F9C4D1D60269836536420F226105F6B5C49DC28
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Jamaica) {. {-9223372036854775808 -18432 0 LMT}. {-2524503168 -18432 0 KMT}. {-1827687168 -18000 0 EST}. {136364400 -14400 0 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {441781200 -18000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Jujuy

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.89710274358395
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MI1VAIgp/MI+290pPGe90/MIE:MBaIMY/Mvp/Mh290h390/MB
MD5:	320C83EFE59FD60EB9F5D4CF0845B948
SHA1:	5A71DFAE7DF9E3D8724DFA533A37744B9A34FFEC
SHA-256:	67740B2D5427CFCA70FB53ABD2356B62E01B782A51A805A324C4DFAD9ACA0CFA
SHA-512:	D7A6378372386C45C907D3CB48B923511A719794B0C0BFA3694DBCE094A46A48249720653836C2F10CBB2178DD8EEEEA6B5019E4CC6C6B650FD7BE256BE1CA99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Jujuy)]} {. LoadTimeZoneFile America/Argentina/Jujuy.}.set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy).

C:\ProgramData\assignee\tcl\tzdata\America\Juneau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	3.882476905033879
Encrypted:	false
SSDEEP:	96:JZL19jPaps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:fB9jPP/4h5sBPy+CMt/ElALLVuAH
MD5:	C2C6145B7E41983259343FFE5992EA35
SHA1:	467D9EBCF3F0A5FC5B03F662A606125F5C10692F
SHA-256:	189658620FE07CF20EEABCD3968A9C1A497576F83592C9622D964E48FC4E9A51
SHA-512:	41C791BF2885B5C0ED7DE5DB1B34B22F67C699C0E3248563DAA8DAEE92E2D02168F6CC21DE6D1B3EDEFC71E6FDFD09AEDB1D768A8435583C14FACCA59CF1C686
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Juneau) {. {-9223372036854775808 54139 0 LMT}. {-3225366139 -32261 0 LMT}. {-2188954939 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600

C:\ProgramData\assignee\tcl\tzdata\America\Kentucky\Louisville

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	3.769996646995791
Encrypted:	false
SSDEEP:	192:wmXxSkUArUfxLURWu3O5bMQxXI6Xah0drn+qvOTFhPI1jFIL:wmXxSkUArUfxLUwu3O5bMQxXI6Xah2n8
MD5:	D9BC20AFD7DA8643A2091EB1A4B48CB3
SHA1:	9B567ABF6630E7AB231CAD867AD541C82D9599FF
SHA-256:	B4CC987A6582494779799A32A9FB3B4A0D0298425E71377EB80E2FB4AAAEB873
SHA-512:	0BC769A53E63B41341C25A0E2093B127064B589F86483962BD24DB4082C4466E12F4CD889B82AD0134C992E984EF0897113F28321522B57BA45A98C15FF7E172
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Louisville) {. {-9223372036854775808 -20582 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1546279200 -21600 0 CST}. {-1535904000 -18000 1 CDT}. {-1525280400 -21600 0 CST}. {-905097600 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-744224400 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-684349200 -18000 1 CDT}. {-652899600 -18000 1 CDT}. {-620845200 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1

C:\ProgramData\assignee\tcl\tzdata\America\Kentucky\Monticello

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8279
Entropy (8bit):	3.785637200740036
Encrypted:	false
SSDEEP:	192:jFPXxEOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+gqvOTFhPI1jFIL:5PXxEOdXkqbfNTzZSJw5/9/yuvQ6crD9
MD5:	0C6F5C9D1514DF2D0F8044BE27080EE2
SHA1:	70CBA0561E4319027C60FB0DCF29C9783BFE8A75
SHA-256:	1515460FBA496FE8C09C87C51406F4DA5D77C11D1FF2A2C8351DF5030001450F
SHA-512:	17B519BCC044FE6ED2F16F2DFBCB6CCE7FA83CF17B9FC4A40FDA21DEFBA9DE7F022A50CF5A264F3090D57D51362662E01C3C60BD125430AEECA0887BB8520DB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Monticello) {. {-9223372036854775808 -20364 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-63136800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 C

C:\ProgramData\assignee\tcl\tzdata\America\Knox_IN

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.8191308888643345
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GKXFVAIgp3GK4N2901iZ903GKk:MBaIMY3GKXQp3GKe290Q903GKk
MD5:	465D405C9720EB7EC4BB007A279E88ED
SHA1:	7D80B8746816ECF4AF45166AED24C731B60CCFC6
SHA-256:	BE85C86FBD7D396D2307E7DCC945214977829E1314D1D71EFAE509E98AC15CF7
SHA-512:	C476022D2CC840793BF7B5841051F707A30CCAB1022E30FB1E45B420077417F517BEDA5564EFB154283C7C018A9CA09D10845C6A1BFE2A2DE7C939E307BDCE6F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox).

C:\ProgramData\assignee\tcl\tzdata\America\Kralendijk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.810917109656368
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE1QOa0IAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE2901Qv0k
MD5:	4763D6524D2D8FC62720BCD020469FF6
SHA1:	EE567965467E4F3BDFE4094604E526A49305FDD8
SHA-256:	A794B43E498484FFD83702CFB9250932058C01627F6F6F4EE1432C80A9B37CD6
SHA-512:	37462E0A3C24D5BAEBDD1ADCF8EE94EA07682960D710D57D5FD05AF9C5F09FF30312528D79516A16A0A84A2D351019DBB33308FC39EC468033B18FB0AC872C13
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Kralendijk) $TZData(:America/Curacao).

C:\ProgramData\assignee\tcl\tzdata\America\La_Paz

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.906725349443972
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEyUMWkXGm2OHpJvvvX+nFp1vZSsXxymxvUmBXlVvxC:SlSWB9X5290Xm2OHphvPKZpydmBVVI
MD5:	6682484C3A44609C949CA050DF75F9F0
SHA1:	6BCFA42D53F55FE7D9F12533C0E79B0C6D3F9BF2
SHA-256:	1476CDDA7BBDD80542FE7EE81516511C47B2CDA336D7290D7329C43D43CE90BB
SHA-512:	5B5FB9CF6E156B058CCDEBEC4C3A1941D7F5AF59C4AB00FDE5ACBD71A1D006960D7A151BF575349DC961AE4CADA8406080C77281AA5960338374882FF38FF4AF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/La_Paz) {. {-9223372036854775808 -16356 0 LMT}. {-2524505244 -16356 0 CMT}. {-1205954844 -12756 1 BOST}. {-1192307244 -14400 0 BOT}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Lima

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.3934794282318315
Encrypted:	false
SSDEEP:	12:MBp5290BbmdH4VPvut/Na/k0QXR/uFmC3/kFe/uFis/kZ/kkF/k88/kUS1F5/kL:cQye8mVNa85R/uH8o/u4s8Z8O8V8USPS
MD5:	8B7AA48D355E4DFCA5F70CF5D6EF7757
SHA1:	817CDC27C7CB4642A7BD3239506ECAECB1852815
SHA-256:	893146B4F7521C089A22354A8314812736AAF8C64DFF0364A1083A4181BDEA48
SHA-512:	38E2FC1774718BC10EB1440DDCE83310262086D14DA17E157873B86814EFCDB047687F05D44B168206AE752ADAC5BF2E78FDD3676B7CC65D0144B0869F1E9481
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Lima) {. {-9223372036854775808 -18492 0 LMT}. {-2524503108 -18516 0 LMT}. {-1938538284 -14400 0 PEST}. {-1002052800 -18000 0 PET}. {-986756400 -14400 1 PEST}. {-971035200 -18000 0 PET}. {-955306800 -14400 1 PEST}. {-939585600 -18000 0 PET}. {512712000 -18000 0 PET}. {544248000 -18000 0 PET}. {638942400 -18000 0 PET}. {765172800 -18000 0 PET}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Los_Angeles

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	3.765996600201645
Encrypted:	false
SSDEEP:	192:lWf/5LB6xN9jgNf+aNwj/lpmlOxnKcndIG:lW35LB6xN9wfefnK6
MD5:	3647C4B5DEE91CF5D9F69683719A0DE1
SHA1:	99A2399CA36C06F80094875EE6EE505A2347D0B0
SHA-256:	C4E241FED91FA8CA0AE3DD44528BB962FC86F505865BABD2FD5621B9FAE3AE12
SHA-512:	051FC88881E21BC1B1BE22410A16A79F122051D5DA7FF24E9A01D1265960058827E814BFFE51B9592F2186E57305B6259A81064A006247973F26EFE949D6ACCF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Los_Angeles) {. {-9223372036854775808 -28378 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-687967200 -25200 1 PDT}. {-662655600 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368632800 -25200 1 PDT}. {-355330800 -28800 0 PST}. {

C:\ProgramData\assignee\tcl\tzdata\America\Louisville

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.866250035215905
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y71PiKp4ozFVAIgp1PiKp4zL290hp4901PiKp4/:MBaIMYPyJpPyzL290P490Py/
MD5:	3BAD2D8B6F2ECB3EC0BFA16DEAEBADC3
SHA1:	2E8D7A5A29733F94FF247E7E62A7D99D5073AFDC
SHA-256:	242870CE8998D1B4E756FB4CD7097FF1B41DF8AA6645E0B0F8EB64AEDC46C13C
SHA-512:	533A6A22A11C34BCE3772BD85B6A5819CCCD98BF7ECED9E751191E5D1AD3B84F34D70F30936CFE501C2FA3F6AAC7ABB9F8843B7EB742C6F9C2AD4C22D5C73740
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Kentucky/Louisville)]} {. LoadTimeZoneFile America/Kentucky/Louisville.}.set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville).

C:\ProgramData\assignee\tcl\tzdata\America\Lower_Princes

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.81236985301262
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGEyOqdVM1h4IAcGE9Cva:SlSWB9IZaM3y79CzVAIgp9CE290h48hf
MD5:	EBB062CC0AA5C21F7C4278B79B9EAE6C
SHA1:	6DFC8303BBE1FB990D7CB258E7DBC6270A5CFE64
SHA-256:	4842420076033349DD9560879505326FFAB91BED75D6C133143FFBBFB8725975
SHA-512:	5087C6257CA797317D049424324F5DC31BBD938436DCEB4CF4FE3D2520F7745F1C023E3EC48689957E389900EF2AACB3F5E9E49FD154DF51FF89F9A7173818CD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Lower_Princes) $TZData(:America/Curacao).

C:\ProgramData\assignee\tcl\tzdata\America\Maceio

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	3.958253749053277
Encrypted:	false
SSDEEP:	24:cQGEekqc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+evIG+M+w+T+v+F+w+m:5NP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wp
MD5:	9823A3BC9616E044820930E13097868D
SHA1:	F672D334FC77CC693FD358E9D5D9F498DD5675DA
SHA-256:	ACF6164AF86348F33ABB16E0961EF5291EF8DFEB23524CCDD2DB021A2BF5DE8F
SHA-512:	BA9B86318C714DA49CC957C65B24257C65185BBCB5BCDC017D918E563711770151D9DA69B5CC8D06F8290F844B396ED4A5416BD5247A8BF772D287D1E292EE4B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Maceio) {. {-9223372036854775808 -8572 0 LMT}. {-1767217028 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7200

C:\ProgramData\assignee\tcl\tzdata\America\Managua

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.233264210289004
Encrypted:	false
SSDEEP:	12:MBp5290znTsmdHOYPprva6/wLAyM/uFn/V8/uFn/3Y/oA2P/RASx/uFn/G/uFn/M:cQGnoeOshRIpMSn/V8Sn/3YVgJvxSn/6
MD5:	6BF9AB156020E7AC62F93F561B314CB8
SHA1:	7484A57EADCFD870490395BB4D6865A2E024B791
SHA-256:	D45B4690B43C46A7CD8001F8AE950CD6C0FF7B01CD5B3623E3DD92C62FD5E473
SHA-512:	CF02E62650679D8E2D58D0D70DE2322CAAA6508AF4FF7A60E415AA8AA3A9D26D1A191CFAE986ACAF0AEF1DFC4C2E34F9A5B6EDC2018E0B7E9000917D429FB587
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Managua) {. {-9223372036854775808 -20708 0 LMT}. {-2524500892 -20712 0 MMT}. {-1121105688 -21600 0 CST}. {105084000 -18000 0 EST}. {161758800 -21600 0 CST}. {290584800 -18000 1 CDT}. {299134800 -21600 0 CST}. {322034400 -18000 1 CDT}. {330584400 -21600 0 CST}. {694260000 -18000 0 EST}. {717310800 -21600 0 CST}. {725868000 -18000 0 EST}. {852094800 -21600 0 CST}. {1113112800 -18000 1 CDT}. {1128229200 -21600 0 CST}. {1146384000 -18000 1 CDT}. {1159682400 -21600 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Manaus

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	4.001810227798472
Encrypted:	false
SSDEEP:	24:cQGnveIo6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9/:5/6SklVySklTpiSklo5Skl5oSklOsSk6
MD5:	63089A24AA65FCBAC0EC0FBDFAA1499E
SHA1:	5798A49922AD78C2097E5C6448699D8DB309646A
SHA-256:	7C891305E72EDFCDCFDBEBDB818F4594C87A9D1CFEAE03E656AEFEDD0914D201
SHA-512:	71182C327086BF7B9D4F832282D62EE22710230938D85155219FEFFCEAC7D1F76055A9CDCB6FB23A47C5AACFFC97056EB66E4BAEAD6DBA3075C80074927D21E0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Manaus) {. {-9223372036854775808 -14404 0 LMT}. {-1767211196 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}. {5

C:\ProgramData\assignee\tcl\tzdata\America\Marigot

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.845378094505442
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y75AJL4DvFVAIgp5AJ3L290zzJ/905AJLv:MBaIMYqJL40pqJ3L290zzN90qJLv
MD5:	88E185B51CF6075B507015F17126DF39
SHA1:	B3CF26514CBC88AC3DAE9AA1B11900151ED23FCD
SHA-256:	5FACA1EE34C2476DB017BF945825FCCEEF37BE632565E7863CC20BE75EA300F9
SHA-512:	ED5C0A44A294366D331AA9855234C832E734005C6144238ABAFC101D87035096C66FDF6F91EF78D3DE160467F66DD88DDD722851C2A867B756EEAE62D1353871
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Guadeloupe)]} {. LoadTimeZoneFile America/Guadeloupe.}.set TZData(:America/Marigot) $TZData(:America/Guadeloupe).

C:\ProgramData\assignee\tcl\tzdata\America\Martinique

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.7982301339896285
Encrypted:	false
SSDEEP:	6:SlSWB9X5290zlJm2OHfueP9dMQR5OfT/VVFUFkCFeR/r:MBp5290znmdHfnP9dMQR5Gb/uFkCFO/r
MD5:	2F7A1415403071E5D2E545C1DAA96A15
SHA1:	6A8FB2ABAD2B2D25AF569624C6C9AAE9821EF70B
SHA-256:	40F3C68A518F294062AC3DD5361BB9884308E1C490EF11D2CFDC93CB219C3D26
SHA-512:	3E4D94AB6A46E6C3BB97304F3A5596A06041C0E0935CC840F4A6EB56D0892778F853959A742C5B832CD8F07AB9B74539C45599F22C080577503B2E34B6CE28C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Martinique) {. {-9223372036854775808 -14660 0 LMT}. {-2524506940 -14660 0 FFMT}. {-1851537340 -14400 0 AST}. {323841600 -10800 1 ADT}. {338958000 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Matamoros

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	3.7582526108760064
Encrypted:	false
SSDEEP:	192:t+vN41+z6stuNEsRZLbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsr2:taN41+z6stuNEsRZLbXwDTIRqfh57TlE
MD5:	2BBAA150389EAAE284D905A159A61167
SHA1:	0001B50C25FC0CDF015A60150963AAF895EEDEEF
SHA-256:	A7966B95DBE643291FB68E228B60E2DC780F8155E064D96B670C8290F104E4AB
SHA-512:	87CE18E7E4C2C59A953CD47005EF406F4923730459996B1BF09B04FFD9CD5F963A9E50299ECCDBF4B24C565412B706B1ABC39890D659E6F409F1BA50308E57F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Matamoros) {. {-9223372036854775808 -24000 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C

C:\ProgramData\assignee\tcl\tzdata\America\Mazatlan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6619
Entropy (8bit):	3.788952004807415
Encrypted:	false
SSDEEP:	96:W7ezBT8tRkfKxhzY720zaOXmlITHjLc1cb:X8tRkfKv+2wB9h
MD5:	4D63766E65BF3E772CCEC2D6DB3E2D3E
SHA1:	DB541D2908159C7EF98F912D8DBC36755FFD13F3
SHA-256:	81CEA4A397AF6190FD250325CF513976B3508209AE3A88FDFD55490A5016A36D
SHA-512:	DFAF1B3547B1B1B78B33F1F0F5E9624C693492687EC5D060FC4C6CBE2AFBB61B2E9B618133636DD62364D28B2450F741561AADFDE7B811F579BBC7247343A041
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mazatlan) {. {-9223372036854775808 -25540 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600

C:\ProgramData\assignee\tcl\tzdata\America\Mendoza

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.76389929825594
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MBVAIgp/Ma290zpH+90/MI:MBaIMY/Mcp/Ma290zpe90/MI
MD5:	A6EFD8F443D4CB54A5FB238D4D975808
SHA1:	8F25C6C0EA9D73DC8D1964C4A28A4E2E783880CC
SHA-256:	39B34B406339F06A8D187F8CCC1B6BF2550E49329F7DCE223619190F560E75F8
SHA-512:	4B5D48472D56AF19B29AD2377573CC8CB3ED9EF1AF53C00C907B6576FA852EA3D1E9F9B3A78A280DC44F8ADBE5B81D6AEC2609BE08FFA08507CD0F4139878F46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Mendoza)]} {. LoadTimeZoneFile America/Argentina/Mendoza.}.set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza).

C:\ProgramData\assignee\tcl\tzdata\America\Menominee

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8136
Entropy (8bit):	3.7460641906933345
Encrypted:	false
SSDEEP:	192:oXxj07ffkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvC:oXxj07ffNTzZSJw5/9/yuvQ6crD57X0w
MD5:	0D0DC4A816CDAE4707CDF4DF51A18D30
SHA1:	7ED2835AA8F723B958A6631092019A779554CADE
SHA-256:	3C659C1EAC7848BBE8DF00F857F8F81D2F64B56BD1CEF3495641C53C007434FA
SHA-512:	930F2FDC2C1EAE4106F9B37A16BCBBAF618A2CCBBA98C712E8215555CF09B9303D71842DEC38EFAF930DB71E14E8208B14E41E10B54EF98335E01435D0FC3518
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Menominee) {. {-9223372036854775808 -21027 0 LMT}. {-2659759773 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-116438400 -18000 1 CDT}. {-100112400 -21600 0 CST}. {-21484800 -18000 0 EST}. {104914800 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1

C:\ProgramData\assignee\tcl\tzdata\America\Merida

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6435
Entropy (8bit):	3.757504464563519
Encrypted:	false
SSDEEP:	192:gN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmR:gN41+z6stuNEsRZjWqZL/1dCYDDCxyHo
MD5:	A7C5CFE3FA08D4CEDF6324457EA5766E
SHA1:	83BB96398C0B1B34771940C8F7A19CB78C5EF72F
SHA-256:	A1D7DE7285DC78ADDE1B0A04E05DA44D0D46D4696F67A682D0D28313A53825FE
SHA-512:	092DD7CEF6A5861472965E082171937EEDCFB3AE1821E3C88AA1BDFAB1EC48F765CAC497E3E5C78C19653C78B087C7CE28A8AB76F9073558963234901EF4B4A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Merida) {. {-9223372036854775808 -21508 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {407653200 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD

C:\ProgramData\assignee\tcl\tzdata\America\Metlakatla

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.049022161950097
Encrypted:	false
SSDEEP:	24:cQG6JeNYesEmlJ14Rs/a4H/YDmD1bSSs8TZZTnEjnz4pUV/NbQKmScg/kg6TgJTg:5OYvP06z9N1e5udv
MD5:	387FE732AECFB958BD026A71AF0D910D
SHA1:	09281AF828298725C09E6C5274C96A5AAC3E75F5
SHA-256:	60CD2B0A686A0A4689EBCDB70E26AD96A07AD4389738C942BFBE733D060310DA
SHA-512:	A873A9722ADDB7C2B3BEA4D02440A29ED8D79ECCC1740730CD7B5308B226F11A122F4453934D02375F714F9EB0B592BE2FE934258ED16A34C31D02980BC7F3F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Metlakatla) {. {-9223372036854775808 54822 0 LMT}. {-3225366822 -31578 0 LMT}. {-2188955622 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677

C:\ProgramData\assignee\tcl\tzdata\America\Mexico_City

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6807
Entropy (8bit):	3.761365047166545
Encrypted:	false
SSDEEP:	192:VeE7nN41+zKstuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sQ:VeE7nN41+zKstuNEsRZjWqZL/1dCYDDK
MD5:	C675DA8A44A9841C417C585C2661EF13
SHA1:	147DDE5DD00E520DA889AC9931088E6232CE6FEA
SHA-256:	82B9AAD03408A9DFC0B6361EC923FEAEF97DBB4B3129B772B902B9DAE345D63E
SHA-512:	00615A5EC0D08BABF009C3CAAF3D631B1F4E2E4324E91B0F29ADD7E61B51C80D5D495D20BD131A9370C3005B2E510C8A4E4869A5032D82BC33C875E909CDE086
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mexico_City) {. {-9223372036854775808 -23796 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-975261600 -18000 1 CDT}. {-963169200 -21600 0 CST}. {-917114400 -18000 1 CDT}. {-907354800 -21600 0 CST}. {-821901600 -18000 1 CWT}. {-810068400 -21600 0 CST}. {-627501600 -18000 1 CDT}. {-612990000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001836800 -21600 0 CST}. {1014184800 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000

C:\ProgramData\assignee\tcl\tzdata\America\Miquelon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	3.8399423763277087
Encrypted:	false
SSDEEP:	192:FtGlRdJVKU7c7q5lynu9b4HwXz+SqgNyz0T2CKm8qHmqpiq21PjgDCghEpW12YXq:ExKZ651i
MD5:	3BE359FC305B39DE06AEBC7E1DA63F42
SHA1:	1F4DD606C5CC277DACC7678E8B82A9C8E8ACDD4F
SHA-256:	BB8E349500B467FE8F2670AF36F8237C12B513CF2832005E70281309C3AA057A
SHA-512:	85017DFFF1BDE833737AF09673CB9001E7EFD10B7C7E83659D425150E11BD1FA56DF8DEC921DB279A853C0379CC15E720BFBB109A8100A3B3D1B4030128BB34A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Miquelon) {. {-9223372036854775808 -13480 0 LMT}. {-1850328920 -14400 0 AST}. {326001600 -10800 0 PMST}. {536468400 -10800 0 PMST}. {544597200 -7200 1 PMDT}. {562132800 -10800 0 PMST}. {576046800 -7200 1 PMDT}. {594187200 -10800 0 PMST}. {607496400 -7200 1 PMDT}. {625636800 -10800 0 PMST}. {638946000 -7200 1 PMDT}. {657086400 -10800 0 PMST}. {671000400 -7200 1 PMDT}. {688536000 -10800 0 PMST}. {702450000 -7200 1 PMDT}. {719985600 -10800 0 PMST}. {733899600 -7200 1 PMDT}. {752040000 -10800 0 PMST}. {765349200 -7200 1 PMDT}. {783489600 -10800 0 PMST}. {796798800 -7200 1 PMDT}. {814939200 -10800 0 PMST}. {828853200 -7200 1 PMDT}. {846388800 -10800 0 PMST}. {860302800 -7200 1 PMDT}. {877838400 -10800 0 PMST}. {891752400 -7200 1 PMDT}. {909288000 -10800 0 PMST}. {923202000 -7200 1 PMDT}. {941342400 -10800 0 PMST}. {954651600 -7200 1 PM

C:\ProgramData\assignee\tcl\tzdata\America\Moncton

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10165
Entropy (8bit):	3.73501024949866
Encrypted:	false
SSDEEP:	192:XYtQYUKXZRMavqQS8L2En/RDmzTWRf2oFnoF8l988fL8vG+81VcfnrpbX+qvlrPf:gQYzCO4alKqYvuOdeYP/Jv
MD5:	C1F34BD1FB4402481FFA5ABEE1573085
SHA1:	46B9AD38086417554549C36A40487140256BED57
SHA-256:	A4C2F586D7F59A192D6D326AD892C8BE20753FB4D315D506F4C2ED9E3F657B9A
SHA-512:	115D3E65A6A3834E748ED1917CF03A835F74EC0F8DB789C2B99EB78879EA3A5A2AFEB35981BA221D868E6A5B579374CFB3F865ACF6D4271B918EBCC2C3C69579
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Moncton) {. {-9223372036854775808 -15548 0 LMT}. {-2715882052 -18000 0 EST}. {-2131642800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1167595200 -14400 0 AST}. {-1153681200 -10800 1 ADT}. {-1145822400 -14400 0 AST}. {-1122231600 -10800 1 ADT}. {-1114372800 -14400 0 AST}. {-1090782000 -10800 1 ADT}. {-1082923200 -14400 0 AST}. {-1059332400 -10800 1 ADT}. {-1051473600 -14400 0 AST}. {-1027882800 -10800 1 ADT}. {-1020024000 -14400 0 AST}. {-996433200 -10800 1 ADT}. {-988574400 -14400 0 AST}. {-965674800 -10800 1 ADT}. {-955396800 -14400 0 AST}. {-934743600 -10800 1 ADT}. {-923947200 -14400 0 AST}. {-904503600 -10800 1 ADT}. {-891892800 -14400 0 AST}. {-883598400 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}. {-747252000 -10800 1 ADT}

C:\ProgramData\assignee\tcl\tzdata\America\Monterrey

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6496
Entropy (8bit):	3.75909042772931
Encrypted:	false
SSDEEP:	192:Xc+vN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOt:saN41+z6stuNEsRZjWqZL/1dCYDDCxyI
MD5:	255A5A8E27CA1F0127D71E09033C6D9B
SHA1:	4F1C5E6D3F9E5BC9F8958FA50C195FDADD0F4022
SHA-256:	C753DEF7056E26D882DCD842729816890D42B6C7E31522111467C0C39A24B2F2
SHA-512:	96A67C3CC54EC39086D4DF681DDA39B4167FE80F0C45600045480F28C282071915F793BD672146119A22E0C15339F162DFF9DF326E7132E723684EF079666F58
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Monterrey) {. {-9223372036854775808 -24076 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C

C:\ProgramData\assignee\tcl\tzdata\America\Montevideo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	3.7996174594138354
Encrypted:	false
SSDEEP:	192:XnG6+CKN0FXVMspFpFCDBS2lyrDFNaat8VBKeQm/Ihmq/1iKHnXf3WLQWc/WKDW+:3ax2pD
MD5:	FFECDDDDA3716A0E0CDAA72F8E513EBD
SHA1:	F0D39F71694F5DF3BC39F19340E51C4B7B42C560
SHA-256:	B44390E665901FE73BD26CA65BC24D7C98D181D7BD227E7797F589045EC444A7
SHA-512:	F56357CDF1A19B67E44879243643FEBAFBE4096B2485265A9A81803B786A7501FA1B9EEFAA3E42EC6D62D5AD8C2E8E32785DA4C107B47CBD425E76D58E304802
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Montevideo) {. {-9223372036854775808 -13484 0 LMT}. {-2256668116 -13484 0 MMT}. {-1567455316 -12600 0 UYT}. {-1459542600 -10800 1 UYHST}. {-1443819600 -12600 0 UYT}. {-1428006600 -10800 1 UYHST}. {-1412283600 -12600 0 UYT}. {-1396470600 -10800 1 UYHST}. {-1380747600 -12600 0 UYT}. {-1141590600 -10800 1 UYHST}. {-1128286800 -12600 0 UYT}. {-1110141000 -10800 1 UYHST}. {-1096837200 -12600 0 UYT}. {-1078691400 -10800 1 UYHST}. {-1065387600 -12600 0 UYT}. {-1046637000 -10800 1 UYHST}. {-1033938000 -12600 0 UYT}. {-1015187400 -10800 1 UYHST}. {-1002488400 -12600 0 UYT}. {-983737800 -10800 1 UYHST}. {-971038800 -12600 0 UYT}. {-952288200 -10800 1 UYHST}. {-938984400 -12600 0 UYT}. {-920838600 -10800 1 UYHST}. {-907534800 -12600 0 UYT}. {-896819400 -10800 1 UYHST}. {-853623000 -10800 0 UYT}. {-853621200 -7200 1 UYST}. {-845848800 -10800 0 UYT}

C:\ProgramData\assignee\tcl\tzdata\America\Montreal

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10915
Entropy (8bit):	3.724287892327294
Encrypted:	false
SSDEEP:	192:XMMNzQdbgZ8UMrVWrrn+qvOTFhPI1jFIL:cMNzQdbgZFMrVSn93+
MD5:	824B94F07F7BCB9553490D7A83DD5EC6
SHA1:	BE9F848DA85B28414BEF02B6BB5306ECAC06405E
SHA-256:	6C8EE1D4FDA561253BE39A67F2A7A838C2FA66F850A4AFFBF3FDC8C1D61F5B40
SHA-512:	C2F9D7479994F27531053AA37CAAADE225B6359FDD6A1E98955D0921FD70535A0970DA32698DB3645E52583B45E4A880563112D5F33FF56F98A1BDFC5608C9C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Montreal) {. {-9223372036854775808 -17656 0 LMT}. {-2713892744 -18000 0 EST}. {-1665334800 -14400 1 EDT}. {-1662753600 -18000 0 EST}. {-1640977200 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1609441200 -18000 0 EST}. {-1601742600 -14400 1 EDT}. {-1583775000 -18000 0 EST}. {-1567355400 -14400 1 EDT}. {-1554053400 -18000 0 EST}. {-1535907600 -14400 1 EDT}. {-1522603800 -18000 0 EST}. {-1504458000 -14400 1 EDT}. {-1491154200 -18000 0 EST}. {-1439830800 -14400 1 EDT}. {-1428255000 -18000 0 EST}. {-1409504400 -14400 1 EDT}. {-1396805400 -18000 0 EST}. {-1378054800 -14400 1 EDT}. {-1365355800 -18000 0 EST}. {-1346612400 -14400 1 EDT}. {-1333915200 -18000 0 EST}. {-1315162800 -14400 1 EDT}. {-1301860800 -18000 0 EST}. {-1283713200 -14400 1 EDT}. {-1270411200 -18000 0 EST}. {-1252263600 -14400 1 EDT}. {-123896160

C:\ProgramData\assignee\tcl\tzdata\America\Montserrat

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.963461567788273
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEzQ1XXpXGm2OHdVkevUdRfXR5vwvYv:SlSWB9X5290zQ1HYm2OHXkeG55r
MD5:	93C77D10FCE23705875E206671246BB0
SHA1:	428010B0532A3EABE595CF9947C27F920053410E
SHA-256:	DC184A13889A41F3D6C3425917F0820A5B2BFA9789CE341D09BAEE757DE59454
SHA-512:	AE1D29DBC41B6547ACE391D8BD1D1BE67C991E5D479CD0F0293C411C73E248F700EB7293AD29F4E3789D29FECD19076522B1272422999D5F4600B2DC3C6260E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Montserrat) {. {-9223372036854775808 -14932 0 LMT}. {-1846266608 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Nassau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.7353311910027376
Encrypted:	false
SSDEEP:	96:JUzoaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Gzorn+qvOTFhPI1jFIL
MD5:	6F9F530A792FC34E2B0CEE4BC3DB3809
SHA1:	4DF8A4A6993E47DD5A710BEE921D88FEF44858E7
SHA-256:	9F62117DDA0A21D37B63C9083B3C50572399B22D640262F427D68123078B32F9
SHA-512:	C2BF93FDBE8430113FA63561D1A08145DCF31CD679AB7230098993C7A19EF0F29F486C962656F8A62505CB1BFE993FBD3BB5FB0BAE7B6E7E190DE2865C445408
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nassau) {. {-9223372036854775808 -18570 0 LMT}. {-1825095030 -18000 0 EST}. {-179341200 -14400 1 EDT}. {-163620000 -18000 0 EST}. {-147891600 -14400 1 EDT}. {-131565600 -18000 0 EST}. {-116442000 -14400 1 EDT}. {-100116000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {189320400 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600

C:\ProgramData\assignee\tcl\tzdata\America\New_York

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11004
Entropy (8bit):	3.725417189649631
Encrypted:	false
SSDEEP:	96:iNXYUiZrbgZ8UMr5UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:23iZrbgZ8UMr2wdrn+qvOTFhPI1jFIL
MD5:	C9D78AB6CF796A9D504BE2903F00B49C
SHA1:	A6C0E4135986A1A6F36B62276BFAB396DA1A4A9B
SHA-256:	1AB6E47D96BC34F57D56B936233F58B5C748B65E06AFF6449C3E3C317E411EFE
SHA-512:	6D20B13F337734CB58198396477B7C0E9CB89ED4D7AB328C22A4A528CAF187D10F42540DBB4514A0C139E6F4AE9A1A71AED02E3735D1D4F12C5314014C0C1EB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/New_York) {. {-9223372036854775808 -17762 0 LMT}. {-2717650800 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-1577905200 -18000 0 EST}. {-1570381200 -14400 1 EDT}. {-1551636000 -18000 0 EST}. {-1536512400 -14400 1 EDT}. {-1523210400 -18000 0 EST}. {-1504458000 -14400 1 EDT}. {-1491760800 -18000 0 EST}. {-1473008400 -14400 1 EDT}. {-1459706400 -18000 0 EST}. {-1441558800 -14400 1 EDT}. {-1428256800 -18000 0 EST}. {-1410109200 -14400 1 EDT}. {-1396807200 -18000 0 EST}. {-1378659600 -14400 1 EDT}. {-1365357600 -18000 0 EST}. {-1347210000 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-122080680

C:\ProgramData\assignee\tcl\tzdata\America\Nipigon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7836
Entropy (8bit):	3.7462966187089535
Encrypted:	false
SSDEEP:	96:rEa2raC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:rYrrn+qvOTFhPI1jFIL
MD5:	3D389AA51D3E29E8A1E8ED07646AA0DD
SHA1:	2E3DF9406B14662ADEDDC0F891CD81DF23D98157
SHA-256:	3A0FB897E5CCB31B139E009B909053DCE36BB5791ACF23529D874AFA9F0BB405
SHA-512:	AFF7B30355ECB6EBD43D1E6C943C250AB98CC82BDC8DDC7595769E4CE188A23591AEFCF18A028CC6479CF6AA20F65980E37C74F6CEE907537366136FAF29B66E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nipigon) {. {-9223372036854775808 -21184 0 LMT}. {-2366734016 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-923252400 -14400 1 EDT}. {-880218000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}.

C:\ProgramData\assignee\tcl\tzdata\America\Nome

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.8859165156616937
Encrypted:	false
SSDEEP:	96:OMmWQm825s/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:OMmWQmI/4h5sBPy+CMt/ElALLVuAH
MD5:	ECBBCB3C63125333C1339EFF2C02BACE
SHA1:	293B8D9314F57F54A7C0457C0C661A5DB2EFE026
SHA-256:	9739527976A9FF2753C1D986C3901F9A537E1F9387BE2543BB00257DD9D8881A
SHA-512:	AB22FC48ABC2B773522F37B929961774B80B1EF4CE76837AEDB1E6640DEB4D8C46CE89E3A24854F2D684579EB1BD9790AF9EBDFF3556A621ECB2AF66F32EC256
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nome) {. {-9223372036854775808 46701 0 LMT}. {-3225358701 -39698 0 LMT}. {-2188947502 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3

C:\ProgramData\assignee\tcl\tzdata\America\Noronha

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	4.01376478240381
Encrypted:	false
SSDEEP:	24:cQ8eHChYsS590B74LmCUGXx1bvzbsgEfKaccbMuSEh:5ghYsSDK74LmCUGB1bvzbsgEfK1couSK
MD5:	38D2ADBD4CC7A54D3EDDC120BE4E32E9
SHA1:	07AEFC41171850277C4ECF30B3C5108ED196926D
SHA-256:	03C9461769527F6D7639E79CBACB71452B01BA08172D1105D2AC36458622F0D7
SHA-512:	F6FBE1E1AB9D66A12DEEAC6FA5536B0ACFC9F777D5E270B05BD3144B1065AE02BEC157A57686F5EDA443498BA1B01B9F445C902ADCB33412FE73036AD3B29CFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Noronha) {. {-9223372036854775808 -7780 0 LMT}. {-1767217820 -7200 0 FNT}. {-1206961200 -3600 1 FNST}. {-1191366000 -7200 0 FNT}. {-1175378400 -3600 1 FNST}. {-1159830000 -7200 0 FNT}. {-633823200 -3600 1 FNST}. {-622072800 -7200 0 FNT}. {-602287200 -3600 1 FNST}. {-591836400 -7200 0 FNT}. {-570751200 -3600 1 FNST}. {-560214000 -7200 0 FNT}. {-539128800 -3600 1 FNST}. {-531356400 -7200 0 FNT}. {-191368800 -3600 1 FNST}. {-184201200 -7200 0 FNT}. {-155167200 -3600 1 FNST}. {-150073200 -7200 0 FNT}. {-128901600 -3600 1 FNST}. {-121129200 -7200 0 FNT}. {-99957600 -3600 1 FNST}. {-89593200 -7200 0 FNT}. {-68421600 -3600 1 FNST}. {-57970800 -7200 0 FNT}. {499744800 -3600 1 FNST}. {511232400 -7200 0 FNT}. {530589600 -3600 1 FNST}. {540262800 -7200 0 FNT}. {562125600 -3600 1 FNST}. {571194000 -7200 0 FNT}. {592970400 -3600 1 FNST}. {6

C:\ProgramData\assignee\tcl\tzdata\America\North_Dakota\Beulah

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.7975723806562063
Encrypted:	false
SSDEEP:	192:raF2dVtXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Dac5TE35:OFcVtXwDTIRqfh57Tlto//q7u379zlqw
MD5:	15AABAE9ABE4AF7ABEADF24A510E9583
SHA1:	3DEF11310D02F0492DF09591A039F46A8A72D086
SHA-256:	B328CC893D217C4FB6C84AA998009940BFBAE240F944F40E7EB900DEF1C7A5CF
SHA-512:	7A12A25EB6D6202C47CFDD9F3CE71342406F0EDA3D1D68B842BCFE97EFF1F2E0C11AD34D4EE0A61DF7E0C7E8F400C8CCA73230BDB3C677F8D15CE5CBA44775D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Beulah) {. {-9223372036854775808 -24427 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS

C:\ProgramData\assignee\tcl\tzdata\America\North_Dakota\Center

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.7834920003907664
Encrypted:	false
SSDEEP:	192:LF2dK7X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaT:LFcK7X0N41+IestuNEbYkzbXwDTIRqfK
MD5:	AC804124F4CE4626F5C1FDA2BC043011
SHA1:	4B3E8CC90671BA543112CEE1AB5450C6EA4615DF
SHA-256:	E90121F7D275FDCC7B8DCDEC5F8311194D432510FEF5F5F0D6F211A4AACB78EF
SHA-512:	056EF65693C16CB58EC5A223528C636346DB37B75000397D03663925545979792BBC50B20B5AA20139ECE9A9D6B73DA80C2319AA4F0609D6FC1A6D30D0567C58
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Center) {. {-9223372036854775808 -24312 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS

C:\ProgramData\assignee\tcl\tzdata\America\North_Dakota\New_Salem

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8281
Entropy (8bit):	3.795939700557522
Encrypted:	false
SSDEEP:	192:uF2dyuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Da:uFcyuNEbYkzbXwDTIRqfh57Tlto//q7k
MD5:	E26FC508DFD73B610C5543487C763FF5
SHA1:	8FBDE67AF561037AAA2EDF93E9456C7E534F4B5A
SHA-256:	387D3C57EDE8CCAAD0655F19B35BC0D124C016D16F06B6F2498C1151E4792778
SHA-512:	8A10B7370D1521EDF18AB4D5192C930ABC68AB9AE718ADF3D175EACE9A1F5DAC690A76B02EFB4059374761962D8C2660497F8E951DFE9812FB3CFCFDF9165E45
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/New_Salem) {. {-9223372036854775808 -24339 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0

C:\ProgramData\assignee\tcl\tzdata\America\Ojinaga

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	3.7945318113967823
Encrypted:	false
SSDEEP:	48:5gUFM/6M/Mp5tyTc8Ln4ypZ9giGuWGwZIoktiz+hL5Cw5feQ5BT5rBSNNOVQoh/5:KJNfzo+C2mWBNQMsmNTxf6AeO+cblX
MD5:	D88A28F381C79410D816F8D2D1610A02
SHA1:	81949A1CACD5907CA5A8649385C03813EEFCDDE0
SHA-256:	F65C0F8532387AFE703FACDEE325BF8D7F3D1232DEE92D65426FF917DD582CB3
SHA-512:	9A9B0C65ECDFF690EF2933B323B3A1CF2D67D0A43F285BB9FEEFF275316148A07F5AC044C48F64E3D8CFA7C1DE44AF220A6855DC01225F8BFFF63AEC946B944A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Ojinaga) {. {-9223372036854775808 -25060 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -2520

C:\ProgramData\assignee\tcl\tzdata\America\Panama

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.924365872261203
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEu5fcXGm2OHGf8xYvX5BidhZSsc1HRX1vain:SlSWB9X5290WTm2OHDxYP5GhZE3X1iin
MD5:	771816CABF25492752C5DA76C5EF74A5
SHA1:	6494F467187F99C9A51AB670CD8DC35078D63904
SHA-256:	0E323D15EA84D4B6E838D5DCD99AEE68666AF97A770DA2AF84B7BDCA4AB1DBBA
SHA-512:	C32D918E121D800B9DFD5CE1F13A4BF2505C0EDCE0085639C8EDF48073E0888906F1A28EF375BDCF549DB14CD33F7C405E28BC35DDF22445C224FBC64146B4EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Panama) {. {-9223372036854775808 -19088 0 LMT}. {-2524502512 -19176 0 CMT}. {-1946918424 -18000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Pangnirtung

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7484
Entropy (8bit):	3.7727467213469943
Encrypted:	false
SSDEEP:	192:72KFEUlpde9pXbO53or0gqvOTFhPI1jFIL:y0r3+
MD5:	E740F56827130C3B87CCB84D66AF0392
SHA1:	60830B872B23FB0E3231156FECCAB693D39AA6D8
SHA-256:	775289D3F8A386A22F920BB48476681D4AC3BCCFCC87F51601B29978D6A5D6B6
SHA-512:	16594FC519ADC3995015B16EB9C7C8E552430AE376DE2089F45E2360CC875A0FA0CE0DEDAD888E497E4A8C7CD495895ADEC522F18DA85A1F264373A441AFFD9C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Pangnirtung) {. {-9223372036854775808 0 0 zzz}. {-1546300800 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-147902400 -7200 1 ADDT}. {-131572800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050400 -10800 1 ADT}. {594190800 -14400 0 AST}. {607500000 -10800 1 ADT}. {625640400 -14400 0 AST}. {638949600 -10800 1 ADT}. {657090000 -14400 0 AST}. {671004000 -10800 1 ADT}. {688539600 -14400 0 AST}. {702

C:\ProgramData\assignee\tcl\tzdata\America\Paramaribo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.78889293057406
Encrypted:	false
SSDEEP:	6:SlSWB9X5290oldJm2OHeke3FIMVTvVWKGOT/5g/VVFA:MBp5290olLmdHeV3qSvWOTc/q
MD5:	C8945B3FDD3BAAA0693870F3F85A1D38
SHA1:	A35CC1D2B8D3ABE8AF40F8530D62BB165B9E078F
SHA-256:	DF43D6E1F7F71D633C5112376B2E9FE089CDB7CB9876EAB5E38AF9B0772CBF6F
SHA-512:	AEAFA7561501C125C66F7710C7EBAFD9C56F4FF4B347D868D686A1877253DB074969FC531DF4E475A14DC91C15D39146718A8E5C86E4A2129C478BCF57137227
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Paramaribo) {. {-9223372036854775808 -13240 0 LMT}. {-1861906760 -13252 0 PMT}. {-1104524348 -13236 0 PMT}. {-765317964 -12600 0 NEGT}. {185686200 -12600 0 SRT}. {465449400 -10800 0 SRT}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Phoenix

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.379302206927978
Encrypted:	false
SSDEEP:	12:MBp5290OQmdH514YPFotFg4tFQxRgmjtFdRb2:cQCeksFsFgcFQxBhF7b2
MD5:	1B5C5CBC4168FCCC9100487D3145AF6D
SHA1:	6E9E3074B783108032469C8E601D2C63A573B840
SHA-256:	9E28F87C0D9EE6AD6791A220742C10C135448965E1F66A7EB04D6477D8FA11B0
SHA-512:	4A6527FF5C7F0A0FDC574629714399D9A475EDC1338BF4C9EEEEDCC8CA23E14D2DE4DCA421D46FABA813A65236CD7B8ADBE103B641A763C6BC508738BF73A58C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Phoenix) {. {-9223372036854775808 -26898 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-820519140 -25200 0 MST}. {-796841940 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-56221200 -25200 0 MST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Port-au-Prince

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	3.7695898184176624
Encrypted:	false
SSDEEP:	48:5IV1C8phBVSWroLMEbF8xzqXtWl5Hm0RQU+5oaIOWIF4IPWFeB/5udPOcBqYZ4vX:mKXivOTFhP5S+ijFnRaJeaX1eyDt
MD5:	8580CED12AF23BF83DB337E314EE2B6E
SHA1:	333AB24A58F36B9526888BB4A3B8F5135373A62D
SHA-256:	34A7491EB4BDC94BF02D820E47FDE8AAF0D5037B2E71DD15E8FF61409321687E
SHA-512:	4CA6E99E2EDED083B8B543C9471DE61588BD894A2E4C4550D7F47E31824704CFB39B6BA8E1F1B5EEB5A1ABB2242AC2E7EFEFCFA36EBB60BB67BA0130DF7FCDE4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port-au-Prince) {. {-9223372036854775808 -17360 0 LMT}. {-2524504240 -17340 0 PPMT}. {-1670483460 -18000 0 EST}. {421218000 -14400 1 EDT}. {436334400 -18000 0 EST}. {452062800 -14400 1 EDT}. {467784000 -18000 0 EST}. {483512400 -14400 1 EDT}. {499233600 -18000 0 EST}. {514962000 -14400 1 EDT}. {530683200 -18000 0 EST}. {546411600 -14400 1 EDT}. {562132800 -18000 0 EST}. {576050400 -14400 1 EDT}. {594194400 -18000 0 EST}. {607500000 -14400 1 EDT}. {625644000 -18000 0 EST}. {638949600 -14400 1 EDT}. {657093600 -18000 0 EST}. {671004000 -14400 1 EDT}. {688543200 -18000 0 EST}. {702453600 -14400 1 EDT}. {719992800 -18000 0 EST}. {733903200 -14400 1 EDT}. {752047200 -18000 0 EST}. {765352800 -14400 1 EDT}. {783496800 -18000 0 EST}. {796802400 -14400 1 EDT}. {814946400 -18000 0 EST}. {828856800 -14400 1 EDT}. {846396000 -18000 0 EST}.

C:\ProgramData\assignee\tcl\tzdata\America\Port_of_Spain

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.077805073731929
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEuPXGkXGm2OHUnvUdxKzVvwvYv:SlSWB9X5290eSm2OHkzVr
MD5:	8169D55899164E2168EF50E219115727
SHA1:	42848A510C120D4E834BE61FC76A1C539BA88C8A
SHA-256:	6C8718C65F99AB43377609705E773C93F7993FBB3B425E1989E8231308C475AF
SHA-512:	1590D42E88DD92542CADC022391C286842C156DA4795877EA67FEF045E0A831615C3935E08098DD71CF29C972EDC79084FFCC9AFAB7813AE74EEE14D6CFEFB9D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port_of_Spain) {. {-9223372036854775808 -14764 0 LMT}. {-1825098836 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Porto_Acre

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.818272118524638
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7thtedVAIgpthKQ290msh490thB:MBaIMYdxpR290v490x
MD5:	1C0C736D0593654230FCBB0DC275313B
SHA1:	00518615F97BCFF2F6862116F4DF834B70E2D4CA
SHA-256:	5C97E6DF0FC03F13A0814274A9C3A983C474000AE3E78806B38DF9208372FD54
SHA-512:	2252D17CB4F770124586BBF35974077212B92C1587071C9F552F1EFAC15CBF92128E61C456F9F5154D212F7D66CC5BD85B76B1187D5A6F24E89E14EDF322D67F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco).

C:\ProgramData\assignee\tcl\tzdata\America\Porto_Velho

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	4.067722644085682
Encrypted:	false
SSDEEP:	24:cQQe47o6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9SO:5P6SklVySklTpiSklo5Skl5oSklOsSkO
MD5:	CC959FB88D530F97BA9E62D17B7E5CB8
SHA1:	4BF557B361CDAB9257B111BE1C875FCEAA286FAD
SHA-256:	CA90E1529D142742367EC0728E45B5D601CDBEC591544E5C144A9A69A2FB6ACA
SHA-512:	28A28F01CD1211F73F1B1CF241D56EE5D6C92DF8319481D32BFE11FE87C778DC793A32378E5B6313731B2F206972A25356728C31F90F9583074D4DAEF27EECFD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Porto_Velho) {. {-9223372036854775808 -15336 0 LMT}. {-1767210264 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\ProgramData\assignee\tcl\tzdata\America\Puerto_Rico

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.728240676465187
Encrypted:	false
SSDEEP:	6:SlSWB9X5290pbm2OH9VPMGoeVVFrZVVFUFkeF3k/eJpR/r:MBp5290lmdHvPMpe/ZZ/uFkeF3k/eJ/D
MD5:	2FB893819124F19A7068F802D6A59357
SHA1:	6B35C198F74FF5880714A3182407858193CE37A4
SHA-256:	F05530CFBCE7242847BE265C2D26C8B95B00D927817B050A523FFB139991B09E
SHA-512:	80739F431F6B3548EFD4F70FE3630F66F70CB29B66845B8072D26393ADD7DAB22675BE6DA5FBDC7561D4F3F214816AAD778B6CD0EE45264B4D6FFA48B3AC7C43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Puerto_Rico) {. {-9223372036854775808 -15865 0 LMT}. {-2233035335 -14400 0 AST}. {-873057600 -10800 0 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Rainy_River

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7840
Entropy (8bit):	3.75014960690837
Encrypted:	false
SSDEEP:	192:k+iBktTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVS:k+iBmTzZSJw5/9/yuvQ6crD57X0N41+a
MD5:	9C10496730E961187C33C1AE91C8A60D
SHA1:	A77E3508859FB6F76A7445CD13CD42348CB4EBC7
SHA-256:	136F0A49742F30B05B7C6BF3BF014CC999104F4957715D0BEB39F5440D5216DF
SHA-512:	70936E65D0B439F6BE6E31E27032F10BA2EB54672647DA615744ABC7A767F197F0C7FDBCCEE0D335CBCECB6855B7BD899D1A5B97BA5083FFA42AF5F30343EA7F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rainy_River) {. {-9223372036854775808 -22696 0 LMT}. {-2366732504 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {136368000 -18000 1 CDT}. {152089200 -21600 0 CST}. {167817600 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}.

C:\ProgramData\assignee\tcl\tzdata\America\Rankin_Inlet

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7366
Entropy (8bit):	3.753795978502298
Encrypted:	false
SSDEEP:	192:4w5/9/yuvQ+hcrD57X0N41+IstuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u37N:4w5/9/yuvQ6crD57X0N41+IstuNEbYkJ
MD5:	318E1221CBB525E852AD4154E30C9D72
SHA1:	5D107C7B01407B4716191C9BEB02017471FB2A4D
SHA-256:	FB37D25FD4860EB4AC1596F86B3B6DC7B6EDA9886C71327F91D39F5FAD64FC49
SHA-512:	77D345CA0006D391DD2F0A54075F692A34B37E99F9943C081885A745D7E0F1F6B9FC0F24AA6196A8458926CD7AD97C2B233F62FCEA11EDC80A35126B74A3C35A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rankin_Inlet) {. {-9223372036854775808 0 0 zzz}. {-410227200 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {75205

C:\ProgramData\assignee\tcl\tzdata\America\Recife

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	3.990359910189371
Encrypted:	false
SSDEEP:	24:cQHJeHAqc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+evIG+M+w+w+jZ+SIW:5KAP+Ih+j+R+u+W+iW+M+A+r+hN+gU+q
MD5:	B4D04123688878D611AD09955F51B358
SHA1:	6E0946E726378F5CC9C2BE1F73A2E56166A9039B
SHA-256:	D003E821BA76CE33468AFED3AE5AFD3C85A45E88B4B82CF46E2AFCD0D3334B5A
SHA-512:	2DC6A31093E161EDAB607E04EA943D6F79A43D9B427A402506A8A2933BC891806D0919842DC25A5ECC6EF7BB90E469556EE5FD428A8AE334A6E4EC0D6C426D41
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Recife) {. {-9223372036854775808 -8376 0 LMT}. {-1767217224 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7200

C:\ProgramData\assignee\tcl\tzdata\America\Regina

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	3.956012642028802
Encrypted:	false
SSDEEP:	48:56ecDOBDgE+hIZVEa3lGw+6yZgTX+rNO46wYDW:86VlGS8
MD5:	7D955B277C43D51F19377A91B987FAF9
SHA1:	F2F3E11E955C3E58E21654F3D841B5B1528C0913
SHA-256:	A1FA7BF002B3BA8DCA4D52AA0BB41C047DDAF88B2E542E1FCF81CB3AAF91AA75
SHA-512:	719DEE7A932EDB9255D711E82AC0CA3FCFB07AF3EFE2EE0D887D7137F6059BEBE07F85D910CC0005391D244B4EADA16257BE49787938386FD4B5DB6D8E31D513
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Regina) {. {-9223372036854775808 -25116 0 LMT}. {-2030202084 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1251651600 -21600 1 MDT}. {-1238349600 -25200 0 MST}. {-1220202000 -21600 1 MDT}. {-1206900000 -25200 0 MST}. {-1188752400 -21600 1 MDT}. {-1175450400 -25200 0 MST}. {-1156698000 -21600 1 MDT}. {-1144000800 -25200 0 MST}. {-1125248400 -21600 1 MDT}. {-1111946400 -25200 0 MST}. {-1032714000 -21600 1 MDT}. {-1016992800 -25200 0 MST}. {-1001264400 -21600 1 MDT}. {-986148000 -25200 0 MST}. {-969814800 -21600 1 MDT}. {-954093600 -25200 0 MST}. {-937760400 -21600 1 MDT}. {-922039200 -25200 0 MST}. {-906310800 -21600 1 MDT}. {-890589600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-748450800 -21600 1 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}

C:\ProgramData\assignee\tcl\tzdata\America\Resolute

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7362
Entropy (8bit):	3.7499369602687835
Encrypted:	false
SSDEEP:	192:tw5/9/yuvQ+hcrD57X0N41+IstuNESkzbXwDTIRqfhXbdXvDXpVXVto//q7u379L:tw5/9/yuvQ6crD57X0N41+IstuNESkzV
MD5:	224BE093D948CE13FD07C5E52D0D79D0
SHA1:	DEE0C0BB79F8D31CB023A3CA665B488A2C906BD5
SHA-256:	BF3DA96E2199A2C8683F5BF4AB1501090977C913F396804983C12DEB4DEEDD29
SHA-512:	622CFD5BE51DEE1DFDFFD909C4662D987F39C4556E9777F69A3538D920C1977FC05478C2D2DCD21BF9413D3D1FE7B5E218479CA36BBB70DD1F9CC8D4168602AF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Resolute) {. {-9223372036854775808 0 0 zzz}. {-704937600 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {752050800

C:\ProgramData\assignee\tcl\tzdata\America\Rio_Branco

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	4.058394079269598
Encrypted:	false
SSDEEP:	24:cQYEeH5uwss/uS+L/ux+y/up+a/uj+Ne/ud+Rs/uX4+G/u43+a/uo8+h/u1F+E/h:5q5ZsQt8uqwd4rghFGRhGj+tX1sB
MD5:	0A85ED0235E490A6679786ACEAC08572
SHA1:	2C57ECFBB1B65788FE986501434A1874F25F8DFA
SHA-256:	1AEC2AE3C237CBCE849EFD51EEA54F40018ED33068951969B92EAAFD31E7191C
SHA-512:	191670630E96C390DB61CFAE3B50890E35F57FC60273F23B365EF5D873EFC9160BD1A57D003F8048B545E2436220A08C44F838AB92CCA2DB43891C943CB94CDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rio_Branco) {. {-9223372036854775808 -16272 0 LMT}. {-1767209328 -18000 0 ACT}. {-1206950400 -14400 1 ACST}. {-1191355200 -18000 0 ACT}. {-1175367600 -14400 1 ACST}. {-1159819200 -18000 0 ACT}. {-633812400 -14400 1 ACST}. {-622062000 -18000 0 ACT}. {-602276400 -14400 1 ACST}. {-591825600 -18000 0 ACT}. {-570740400 -14400 1 ACST}. {-560203200 -18000 0 ACT}. {-539118000 -14400 1 ACST}. {-531345600 -18000 0 ACT}. {-191358000 -14400 1 ACST}. {-184190400 -18000 0 ACT}. {-155156400 -14400 1 ACST}. {-150062400 -18000 0 ACT}. {-128890800 -14400 1 ACST}. {-121118400 -18000 0 ACT}. {-99946800 -14400 1 ACST}. {-89582400 -18000 0 ACT}. {-68410800 -14400 1 ACST}. {-57960000 -18000 0 ACT}. {499755600 -14400 1 ACST}. {511243200 -18000 0 ACT}. {530600400 -14400 1 ACST}. {540273600 -18000 0 ACT}. {562136400 -14400 1 ACST}. {571204800 -18000 0 ACT}.

C:\ProgramData\assignee\tcl\tzdata\America\Rosario

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.752946571641783
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MdVAIgp/MOF290rI5290/Msn:MBaIMY/M4p/MOF290r190/Ms
MD5:	4FC460A084DF33A73F2F87B7962B0084
SHA1:	45E70D5D68FC2DE0ACFF76B062ADA17E0021460F
SHA-256:	D1F5FFD2574A009474230E0AA764256B039B1D78D91A1CB944B21776377B5B70
SHA-512:	40045420FE88FA54DE4A656534C0A51357FBAB3EA3B9120DA15526A9DEC7EEC2C9799F4D9A72B6050474AD67490BC28540FDA0F17B7FCAF125D41CBCA96ECCDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba).

C:\ProgramData\assignee\tcl\tzdata\America\Santa_Isabel

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8445
Entropy (8bit):	3.7709584779896055
Encrypted:	false
SSDEEP:	96:Sb4I5mC2ZCAFrAdjyuqd3SHdbV2zSd61u/XZ9ma3mL9:25DarAdjyuqg9bV2x1uCp
MD5:	DCF171E7C58C232BF1F477BD038D15B8
SHA1:	0C3FFF0FDC52537C406EF2598FCBFD26831D69A7
SHA-256:	D1F9859973D8B4E98F57D097F12C32DA9A9CFF6E91F71A7355F41C22BADA6F58
SHA-512:	7370B5D5C199525CD000CEDFE58BCDD8DB8FD5E34CD923E622B6917FC1328DA53653D9B904A5F70371704BEFDB6335BA32C83869857D95CFA78620D54B9A140D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santa_Isabel) {. {-9223372036854775808 -27568 0 LMT}. {-1514736000 -25200 0 MST}. {-1451667600 -28800 0 PST}. {-1343062800 -25200 0 MST}. {-1234803600 -28800 0 PST}. {-1222963200 -25200 1 PDT}. {-1207242000 -28800 0 PST}. {-873820800 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-761677200 -28800 0 PST}. {-686073600 -25200 1 PDT}. {-661539600 -28800 0 PST}. {-504892800 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368632800 -25200 1 PDT}. {-355330800 -28800 0 PST}. {-337183200 -25200 1 PDT}. {-323881200 -28800 0 PST}. {-305733600 -25200 1 PDT}. {-292431600 -28800 0 PST}. {-283968000 -28800 0 PST}. {189331200 -28800 0 PST}. {199274400 -25200 1 PDT}. {

C:\ProgramData\assignee\tcl\tzdata\America\Santarem

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	4.04156999168428
Encrypted:	false
SSDEEP:	24:cQceUho6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9S8:5v6SklVySklTpiSklo5Skl5oSklOsSk8
MD5:	16E6B322ADE028816D19A348B1E9D901
SHA1:	108A88CBE875DBAD31F8AA7611AEC99BF37A6554
SHA-256:	39DF7B763BDB6153DD5916DCE4D220F9A911FCAEBC1FC617C5FF632BD83B2041
SHA-512:	20DA68089C4418E1EFFE987DB5EB6EBA6F82271C236AF1FCBFFAD5450BB2C03CC3D77CA7696965C841EE6B0DE1656FBF8350EBF6A660975B90B87D33841EF78D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santarem) {. {-9223372036854775808 -13128 0 LMT}. {-1767212472 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\ProgramData\assignee\tcl\tzdata\America\Santiago

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8782
Entropy (8bit):	3.771877030948939
Encrypted:	false
SSDEEP:	192:LZAAD/BUZrHljtDqM5rgV7ugM981gh+tLIzx6z31ho1VmTfE3rZZ1LqdkG7xd28g:L+IwxUpf2RsU
MD5:	DAB25ED0D5E9949009CFA399936EFF47
SHA1:	3C8FAA3E974AB0644F908855E98755D56EFD86B4
SHA-256:	E1D5723779CFB015216AF4F392BE99E256D495BF4121CC404F616CF9C8AED081
SHA-512:	91F3A315E88284307C97D10A0888BB154303C319D18592A007C3820E6C3E86E4F50C7868042A7AF593D77C34C7DE4FAFFCF54ED00075188305DC7D6ADB3CB767
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santiago) {. {-9223372036854775808 -16966 0 LMT}. {-2524504634 -16966 0 SMT}. {-1893439034 -18000 0 CLT}. {-1688410800 -16966 0 SMT}. {-1619983034 -14400 0 CLT}. {-1593806400 -16966 0 SMT}. {-1335986234 -18000 0 CLT}. {-1335985200 -14400 1 CLST}. {-1317585600 -18000 0 CLT}. {-1304362800 -14400 1 CLST}. {-1286049600 -18000 0 CLT}. {-1272826800 -14400 1 CLST}. {-1254513600 -18000 0 CLT}. {-1241290800 -14400 1 CLST}. {-1222977600 -18000 0 CLT}. {-1209754800 -14400 1 CLST}. {-1191355200 -18000 0 CLT}. {-1178132400 -14400 1 CLST}. {-870552000 -18000 0 CLT}. {-865278000 -14400 1 CLST}. {-740520000 -14400 1 CLST}. {-736376400 -18000 0 CLT}. {-718056000 -18000 0 CLT}. {-713646000 -14400 0 CLT}. {-36619200 -10800 1 CLST}. {-23922000 -14400 0 CLT}. {-3355200 -10800 1 CLST}. {7527600 -14400 0 CLT}. {24465600 -10800 1 CLST}. {37767600 -14400 0 C

C:\ProgramData\assignee\tcl\tzdata\America\Santo_Domingo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.346772162962135
Encrypted:	false
SSDEEP:	12:MBp5290/SyJmdHhvPu4/G/uFNM/KMVv5/+MVvYx/r0XVvpUB/B7Vvo6I8/05aVvH:cQ+DJeVu4e/uICE5FYxwdpUBZpo65VAO
MD5:	EE407C833EB0E28801B27356ABA678E3
SHA1:	DD22E7B4FFA07B7A97804E92DA3CD8772C2D7507
SHA-256:	72347F7D89EC3D7025FCC3AA0DDA2D594F11BAA12EF2AB55F1677AC4DD5AFE88
SHA-512:	3DDD1C02AB0BC3005B9CD4F58F6349D7001D55F78A51E9D363D98B23B11C78B631B81DAC762E9F18352C2DB612C05E855BB1C0156A148E720C848EBABF48371B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santo_Domingo) {. {-9223372036854775808 -16776 0 LMT}. {-2524504824 -16800 0 SDMT}. {-1159773600 -18000 0 EST}. {-100119600 -14400 1 EDT}. {-89668800 -18000 0 EST}. {-5770800 -16200 1 EHDT}. {4422600 -18000 0 EST}. {25678800 -16200 1 EHDT}. {33193800 -18000 0 EST}. {57733200 -16200 1 EHDT}. {64816200 -18000 0 EST}. {89182800 -16200 1 EHDT}. {96438600 -18000 0 EST}. {120632400 -16200 1 EHDT}. {127974600 -18000 0 EST}. {152082000 -14400 0 AST}. {975823200 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Sao_Paulo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7678
Entropy (8bit):	3.782328041884024
Encrypted:	false
SSDEEP:	192:LdP+2+j+R+u+W+B5+M+A+r+L+v+8+h+2+M+Y+v+c+M+++v+8+/+C+jZ+E+2+A++q:LGWbb8B4
MD5:	B9596E3584EBAFEA5D0257129A03F06D
SHA1:	6FD25D7D4D7A5320D981FF001AAB57EFDB852313
SHA-256:	FA6B2AF6815C1BA6751F0807FEAB49E5E60B4C774A45A96EC6EC3563DA358463
SHA-512:	215BEACD30BC54F416C74A98B597E5B1EEDE627121BF58A12F829E55F921FD3EF9C1C6FF0F639D1929882BC0E7380E73038AA6BFD49E6E7BF28A7711802F4212
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sao_Paulo) {. {-9223372036854775808 -11188 0 LMT}. {-1767214412 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-195429600 -7200 1 BRST}. {-189381600 -7200 0 BRT}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -1

C:\ProgramData\assignee\tcl\tzdata\America\Scoresbysund

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6713
Entropy (8bit):	3.7831757008437528
Encrypted:	false
SSDEEP:	96:P0pq6GNOHfSPRayJvZbzmgyb9qqv95aZIhlVeDEzm:EqBOHfSPRayHbNyb9FHzm
MD5:	29C14A9AFA37EFB29DF4424EB905D3FA
SHA1:	35C7F008987D19925D2BC8C06F31B2F1B323478E
SHA-256:	424C05FE8CE2EB094A0840C97286EC3E32B03B73AE92BC34F68E4E986041615E
SHA-512:	A5F933CD082BD6D09DAF64D2245EA043D2A11A3E0E3373D3877CD4AAF4D6BB5BF9C62771C16AF097B1C9E34CF035F95967537ECD2521B9D074C3C33A43559E93
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Scoresbysund) {. {-9223372036854775808 -5272 0 LMT}. {-1686090728 -7200 0 CGT}. {323841600 -3600 0 CGST}. {338961600 -7200 0 CGT}. {354679200 0 0 EGST}. {370400400 -3600 0 EGT}. {386125200 0 1 EGST}. {401850000 -3600 0 EGT}. {417574800 0 1 EGST}. {433299600 -3600 0 EGT}. {449024400 0 1 EGST}. {465354000 -3600 0 EGT}. {481078800 0 1 EGST}. {496803600 -3600 0 EGT}. {512528400 0 1 EGST}. {528253200 -3600 0 EGT}. {543978000 0 1 EGST}. {559702800 -3600 0 EGT}. {575427600 0 1 EGST}. {591152400 -3600 0 EGT}. {606877200 0 1 EGST}. {622602000 -3600 0 EGT}. {638326800 0 1 EGST}. {654656400 -3600 0 EGT}. {670381200 0 1 EGST}. {686106000 -3600 0 EGT}. {701830800 0 1 EGST}. {717555600 -3600 0 EGT}. {733280400 0 1 EGST}. {749005200 -3600 0 EGT}. {764730000 0 1 EGST}. {780454800 -3600 0 EGT}. {796179600 0 1 EGST}. {811904400 -3600 0 EGT

C:\ProgramData\assignee\tcl\tzdata\America\Shiprock

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.840231755053259
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L2IAcGEtOFBx+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iL290tO09G
MD5:	65307038DB12A7A447284DF4F3E6A3E8
SHA1:	DC28D6863986D7A158CEF239D46BE9F5033DF897
SHA-256:	3FD862C9DB2D5941DFDBA5622CC53487A7FC5039F7012B78D3EE4B58753D078D
SHA-512:	91BC29B7EC9C49D4020DC26F682D0EFBBBEE83D10D79C766A08C78D5FF04D9C0A09288D9696A378E777B65E0C2C2AC8A218C12F86C45BD6E7B5E204AE5FC2335
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:America/Shiprock) $TZData(:America/Denver).

C:\ProgramData\assignee\tcl\tzdata\America\Sitka

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.8797731776796454
Encrypted:	false
SSDEEP:	96:6G19jJps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:6M9jI/4h5sBPy+CMt/ElALLVuAH
MD5:	6A3014865B6330673B4F71C1617C486B
SHA1:	52334201654D421DD97D62D0C12065308E6A9D56
SHA-256:	92C6A715A1994EC61D8879A763EEF2B06FFC15876306DD6262ABBD5D3DA23CE0
SHA-512:	B957F258BDBDDA043AF2FE8D66AE6247998A7CE398A56C641FF4DEA8F70BB63652D8B223F783E82B18570E28AB11E76CB1DA2BE6648F449F9F4D745987E109D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sitka) {. {-9223372036854775808 53927 0 LMT}. {-3225365927 -32473 0 LMT}. {-2188954727 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600 -

C:\ProgramData\assignee\tcl\tzdata\America\St_Barthelemy

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.8867149194613955
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y75AJL4DvFVAIgp5AJ3L290txP905AJLv:MBaIMYqJL40pqJ3L2907P90qJLv
MD5:	6E608C0B4256146ED9FB7DC19F9A19CE
SHA1:	A80F65F087BD57EF199156FE9D9A6FC241C543E2
SHA-256:	CD86D6B4A31A5C965966342F08DF8EA81A1F34BFFEBA4F187D4976375F58D08C
SHA-512:	FB9F52B821853EACD7FE4DCEEA655A859937F7DCAE1C588092C9D44FC94360DE7893854A6A7901C6C6FA096A8EB316A8C423C6A16B205B76E63D61D3AF3E4D3A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Guadeloupe)]} {. LoadTimeZoneFile America/Guadeloupe.}.set TZData(:America/St_Barthelemy) $TZData(:America/Guadeloupe).

C:\ProgramData\assignee\tcl\tzdata\America\St_Johns

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10917
Entropy (8bit):	3.7872036312069963
Encrypted:	false
SSDEEP:	192:Vvprjhbvd8mSGu9EnkBVAZK2GrbrvZeuqpNFT:Vvbvd7SGu9lzoVpDT
MD5:	F87531D6DC9AAFB2B0F79248C5ADA772
SHA1:	E14C52B0F564FA3A3536B7576A2B27D4738CA76B
SHA-256:	0439DA60D4C52F0E777431BF853D366E2B5D89275505201080954D88F6CA9478
SHA-512:	5B43CE25D970EEEFD09865D89137388BD879C599191DE8ACE37DA657C142B6DF63143DBF9DED7659CBD5E45BAB699E2A3AFDD28C76A7CB2F300EBD9B74CDA59D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Johns) {. {-9223372036854775808 -12652 0 LMT}. {-2713897748 -12652 0 NST}. {-1664130548 -9052 1 NDT}. {-1650137348 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1598650148 -9052 1 NDT}. {-1590100148 -12652 0 NST}. {-1567286948 -9052 1 NDT}. {-1551565748 -12652 0 NST}. {-1535837348 -9052 1 NDT}. {-1520116148 -12652 0 NST}. {-1503782948 -9052 1 NDT}. {-1488666548 -12652 0 NST}. {-1472333348 -9052 1 NDT}. {-1457216948 -12652 0 NST}. {-1440883748 -9052 1 NDT}. {-1425767348 -12652 0 NST}. {-1409434148 -9052 1 NDT}. {-1394317748 -12652 0 NST}. {-1377984548 -9052 1 NDT}. {-1362263348 -12652 0 NST}. {-1346534948 -9052 1 NDT}. {-1330813748 -12652 0 NST}. {-1314480548 -9052 1 NDT}. {-1299364148 -12652 0 NST}. {-1283030948 -9052 1 NDT}. {-1267914548 -12652 0 NS

C:\ProgramData\assignee\tcl\tzdata\America\St_Kitts

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.968800062147563
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEt//kXGm2OHqGnvUd8BIIR/vwvYv:SlSWB9X5290t7m2OHZn7+IR/r
MD5:	5E85BFE130D44D10D8C29A8EA8CB28FD
SHA1:	88135E38E73D41EBD56F0C765820080BA5EE2991
SHA-256:	68E7F44E11B5AB62AD8DE974D2CEFE126C0AD8D8FF81C99D25631C917A3D2D05
SHA-512:	BB4A6AFB3A4F068A06CFA4CD6E29252F75F236022EFB681029D764F9E05F07EBD93D8BA36170E1B0EB45D6BCA0FBD212599539A5DBBD12FFE23302CE7AF1F1AB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Kitts) {. {-9223372036854775808 -15052 0 LMT}. {-1825098548 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\St_Lucia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.9223929202701004
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEtkNcXGm2OHkevX9ipcsdSUTVyUPvwvYv:SlSWB9X5290taTm2OHkeP9ip2UTBPr
MD5:	BA63A04FCE84A064CD2C2742CFC5B42F
SHA1:	8915E56A21E5C285A3BAC9D59C9F5032A1717CF4
SHA-256:	B200A7962B867C23CE468D8D87D91381F015F5F35B5C9FCBF5F7D51CB4630882
SHA-512:	FDCF40C63A9EC0344A56AFE765ED03ED35AF3164E71D9AAB528F8C2DDEFD9D5B6989BABD0B67C6725DBDE59B946FDAB5190ABA15C8D4EB1428D8378D8E423E8E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Lucia) {. {-9223372036854775808 -14640 0 LMT}. {-2524506960 -14640 0 CMT}. {-1830369360 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\St_Thomas

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	5.011357022124918
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEtXIMFw/kXGm2OHvdjx5vUdRZKFI0VvwvYv:SlSWB9X5290tXIMFwTm2OHvhGoFVr
MD5:	1EF8B3A2B1D22A263CE23B5265FEB6E5
SHA1:	C897653D036AD049F3CDCC8D747C94A7A82017C9
SHA-256:	F502C6DAB149C49A5079EB49DE9C543D64CA9D3A49B7CEE05270968FA0531215
SHA-512:	C9127ABBA21DCDF6D5C7A2B2171902BC8EF5CBEDDDF36526D7CE5E218C328CBC01C9402FA437B18A74B8693ADDC851D7F38937A1C10F9BC87A97CFDD00868594
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Thomas) {. {-9223372036854775808 -15584 0 LMT}. {-1846266016 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\St_Vincent

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.9525462375838725
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEtPLbREeEXGm2OHeFGevX9oITbFevFadSUVRxzVvwvYv:SlSWB9X5290tzbtm2OHekeP9oInWzUVV
MD5:	AD8BE1BA99D79F1779CA17879E909DC1
SHA1:	EDEACF507F8F4BDE27209C5C8FF03024AA5C805D
SHA-256:	282A54FE6B77CAFD3A6B30378A6D327384DF1ACA88B79309CDEA48B64BF70CC9
SHA-512:	0E2CE9B6391290541E9165660B68A0E0DFF9BB0B99026A37B91FEBCC697F29EF340C0DD5A619D665C9074A2C69504CC41F4985B950E9ED1FB9EB0344C3C8EC5E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Vincent) {. {-9223372036854775808 -14696 0 LMT}. {-2524506904 -14696 0 KMT}. {-1830369304 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Swift_Current

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.182525430299964
Encrypted:	false
SSDEEP:	24:cQce7eUFLxsOCX+FmFyyFDVFdPFxFZA8uFZYV:5NecLGO+6yZzXDZA8KZG
MD5:	1502A6DD85B55B9619E42D1E08C09738
SHA1:	70FF58E29CCDB53ABABA7EBD449A9B34AC152AA6
SHA-256:	54E541D1F410AFF34CE898BBB6C7CC945B66DFC9D7C4E986BD9514D14560CC6F
SHA-512:	99F0EFF9F2DA4CDD6AB508BB85002F38B01BDFDE0CBA1EB2F4B5CA8EAD8AAB645A3C26BECF777DE49574111B37F847EFF9320331AC07E84C8E892B688B01D36B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Swift_Current) {. {-9223372036854775808 -25880 0 LMT}. {-2030201320 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-747241200 -21600 0 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-684342000 -21600 1 MDT}. {-671040000 -25200 0 MST}. {-652892400 -21600 1 MDT}. {-639590400 -25200 0 MST}. {-631126800 -25200 0 MST}. {-400086000 -21600 1 MDT}. {-384364800 -25200 0 MST}. {-337186800 -21600 1 MDT}. {-321465600 -25200 0 MST}. {-305737200 -21600 1 MDT}. {-292435200 -25200 0 MST}. {-273682800 -21600 1 MDT}. {-260985600 -25200 0 MST}. {73472400 -21600 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Tegucigalpa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.580220354026118
Encrypted:	false
SSDEEP:	6:SlSWB9X5290Em2OHskeRbV1UcgdrV/uFn/acD3/uFn/sb9/uFn/yn:MBp5290EmdHsVH1UDB/uFn/z/uFn/k/N
MD5:	004588073FADF67C3167FF007759BCEA
SHA1:	64A6344776A95E357071D4FC65F71673382DAF9D
SHA-256:	55C18EA96D3BA8FD9E8C4F01D4713EC133ACCD2C917EC02FD5E74A4E0089BFBF
SHA-512:	ADC834C393C5A3A7BFD86A933E7C7F594AC970A3BD1E38110467A278DC4266D81C3E96394C102E565F05DE7FBBDA623C673597E19BEC1EA26AB12E4354991066
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tegucigalpa) {. {-9223372036854775808 -20932 0 LMT}. {-1538503868 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}. {1146981600 -18000 1 CDT}. {1154926800 -21600 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Thule

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6666
Entropy (8bit):	3.7481713130223295
Encrypted:	false
SSDEEP:	192:pJunToVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4zjyvUP/ZbJitpJxSIRj:pAWJv
MD5:	8FFE81344C31A51489A254DE97E83C3E
SHA1:	4397D9EDAC304668D95921EF03DFD90F967E772F
SHA-256:	EF6AF4A3FA500618B37AF3CDD40C475E54347D7510274051006312A42C79F20C
SHA-512:	F34A6D44499DE5A4E328A8EAFBA5E77B1B8C04A843160D74978398F1545C821C3034FCBD5ADBFAD8D14D1688907C57E7570023ABD3096D4E4C19E3D3C04428B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thule) {. {-9223372036854775808 -16508 0 LMT}. {-1686079492 -14400 0 AST}. {670399200 -10800 1 ADT}. {686120400 -14400 0 AST}. {701848800 -10800 1 ADT}. {717570000 -14400 0 AST}. {733903200 -10800 1 ADT}. {752043600 -14400 0 AST}. {765352800 -10800 1 ADT}. {783493200 -14400 0 AST}. {796802400 -10800 1 ADT}. {814942800 -14400 0 AST}. {828856800 -10800 1 ADT}. {846392400 -14400 0 AST}. {860306400 -10800 1 ADT}. {877842000 -14400 0 AST}. {891756000 -10800 1 ADT}. {909291600 -14400 0 AST}. {923205600 -10800 1 ADT}. {941346000 -14400 0 AST}. {954655200 -10800 1 ADT}. {972795600 -14400 0 AST}. {986104800 -10800 1 ADT}. {1004245200 -14400 0 AST}. {1018159200 -10800 1 ADT}. {1035694800 -14400 0 AST}. {1049608800 -10800 1 ADT}. {1067144400 -14400 0 AST}. {1081058400 -10800 1 ADT}. {1099198800 -14400 0 AST}. {1112508000 -10800 1 ADT}. {1

C:\ProgramData\assignee\tcl\tzdata\America\Thunder_Bay

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8058
Entropy (8bit):	3.7473289441354263
Encrypted:	false
SSDEEP:	96:hePraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:hirrn+qvOTFhPI1jFIL
MD5:	CE6E17F16AA8BAD3D9DB8BD2E61A6406
SHA1:	7DF466E7BB5EDD8E1CDF0ADC8740248EF31ECB15
SHA-256:	E29F83A875E2E59EC99A836EC9203D5ABC2355D6BD4683A5AEAF31074928D572
SHA-512:	833300D17B7767DE74E6F2757513058FF5B25A9E7A04AB97BBBFFAC5D9ADCC43366A5737308894266A056382D2589D0778EEDD85D56B0F336C84054AB05F1079
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thunder_Bay) {. {-9223372036854775808 -21420 0 LMT}. {-2366733780 -21600 0 CST}. {-1893434400 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {18000 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {126248400 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600

C:\ProgramData\assignee\tcl\tzdata\America\Tijuana

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8470
Entropy (8bit):	3.7667993951223955
Encrypted:	false
SSDEEP:	96:mb4I5mC2ZCAFBWsBNwj/lpmlOxGcKcnRH31t+ucgge:y5DaYaNwj/lpmlOxnKcndIG
MD5:	F993E030963356E9BABBAB56F68C8B2F
SHA1:	779A79ACFCA2BA0E81A00E65D9CE0E6A2C0C5C18
SHA-256:	937C3B2FE7DA094E755AFB8CE9E97CF512E50C4F2086740BB57A77F0EA2BEC3E
SHA-512:	11F2F0FF2629EF30F61C8681BB28415F594A0CFD1930770B4F71C1E69AA615B25BDE5D9CCB167183F66C52BB921408847D6FEF9A4EB3951C8E1BC3577E33CB0B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tijuana) {. {-9223372036854775808 -28084 0 LMT}. {-1514736000 -25200 0 MST}. {-1451667600 -28800 0 PST}. {-1343062800 -25200 0 MST}. {-1234803600 -28800 0 PST}. {-1222963200 -25200 1 PDT}. {-1207242000 -28800 0 PST}. {-873820800 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-761677200 -28800 0 PST}. {-686073600 -25200 1 PDT}. {-661539600 -28800 0 PST}. {-504892800 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368632800 -25200 1 PDT}. {-355330800 -28800 0 PST}. {-337183200 -25200 1 PDT}. {-323881200 -28800 0 PST}. {-305733600 -25200 1 PDT}. {-292431600 -28800 0 PST}. {-283968000 -28800 0 PST}. {189331200 -28800 0 PST}. {199274400 -25200 1 PDT}. {21560

C:\ProgramData\assignee\tcl\tzdata\America\Toronto

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	3.7202964099536917
Encrypted:	false
SSDEEP:	96:9wUYG1dbgZ8UMrEUWraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:9wS1dbgZ8UMrVWrrn+qvOTFhPI1jFIL
MD5:	9C60AFDFA3BA2002BA68673B778194CF
SHA1:	D6D17C82AEC4B85BA7B0F6FCB36A7582CA26A82B
SHA-256:	7744DB6EFE39D636F1C88F8325ED3EB6BF8FA615F52A60333A58BCE579983E87
SHA-512:	3C793BB00725CF37474683EAB70A0F2B2ACAE1656402CDD7E75182988DC20361A8651A624A5220983E3E05333B9817DCBEAF20D34BD55C5128F55474A02A9455
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Toronto) {. {-9223372036854775808 -19052 0 LMT}. {-2366736148 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1609441200 -18000 0 EST}. {-1601753400 -14400 1 EDT}. {-1583697600 -18000 0 EST}. {-1567357200 -14400 1 EDT}. {-1554667200 -18000 0 EST}. {-1534698000 -14400 1 EDT}. {-1524074400 -18000 0 EST}. {-1503248400 -14400 1 EDT}. {-1492365600 -18000 0 EST}. {-1471798800 -14400 1 EDT}. {-1460916000 -18000 0 EST}. {-1440954000 -14400 1 EDT}. {-1428861600 -18000 0 EST}. {-1409504400 -14400 1 EDT}. {-1397412000 -18000 0 EST}. {-1378054800 -14400 1 EDT}. {-1365962400 -18000 0 EST}. {-1346605200 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-1220806800

C:\ProgramData\assignee\tcl\tzdata\America\Tortola

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.944516071480454
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEqMRKCSXGm2OHvV14YvUdRZmxR/vwvYv:SlSWB9X5290RRKCJm2OHvf4YG0X/r
MD5:	CB5F2F9B4B7C8B4DAD8682F1D6563D57
SHA1:	408B11831F1BFF7F435C6CF1085804A18C37A4AF
SHA-256:	BC5E3F9D78430FD1439577ED8384BAB4963A810C6C3AE19B45D69FF985144C1C
SHA-512:	13D989CDAC84083397711DA40B41369B5FA20A2F84114F9773B6AB8C0C962E31B9E7E3CFECD131B2B05D562329608F1156B0E4CD00D534A89D85E82C58D7D9DB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tortola) {. {-9223372036854775808 -15508 0 LMT}. {-1846266092 -14400 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\America\Vancouver

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9495
Entropy (8bit):	3.7630000632404426
Encrypted:	false
SSDEEP:	192:2f7f/5LB6xi9C7Nf+aNwj/lpmlOxnKcndIG:2f735LB6xi9cfefnK6
MD5:	1ACC41DA124C0CA5E67432760FDC91EC
SHA1:	13F56C3F53076E0027BB8C5814EC81256A37F4AF
SHA-256:	DFC19B5231F6A0AB9E9B971574FB612695A425A3B290699DF2819D46F1250DB0
SHA-512:	2F2E358F5743248DE946B90877EFCCCACAF039956249F17D24B7DA026830A181A125045E2C8937A6ACD674E32887049F2D36A1941F09803DF514ADCDA4055CC5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Vancouver) {. {-9223372036854775808 -29548 0 LMT}. {-2713880852 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-747237600 -25200 1 PDT}. {-732726000 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386

C:\ProgramData\assignee\tcl\tzdata\America\Virgin

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.874169230364431
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tXIMVkvFVAIg20tXIKxL2IAcGEoMXgFHp4IAcGEtZ:SlSWB9IZaM3y7tXIMGvFVAIgptXIKxLu
MD5:	0C73023975170F6B3F335FE37FC571A7
SHA1:	23D91BE78C09FEA980FBEF0062A9F7679E180BCB
SHA-256:	243C36A5745ABAE01DB73E60A505C6A0FBA8A41D9536BB71299B08AB7E130841
SHA-512:	0865BEE8DAE02764D92934CC0F1D1055EAB8115F14CA3A3BC37C52303BA72F1FDE4748E47B1990E6F911B243345A80B8338C69AD511DE2CF36B89E2C8270C716
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/St_Thomas)]} {. LoadTimeZoneFile America/St_Thomas.}.set TZData(:America/Virgin) $TZData(:America/St_Thomas).

C:\ProgramData\assignee\tcl\tzdata\America\Whitehorse

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7613
Entropy (8bit):	3.789738507183991
Encrypted:	false
SSDEEP:	96:hmD+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:hm3Nf+aNwj/lpmlOxnKcndIG
MD5:	CBCFD98E08FCCEB580F66AFE8E670AF5
SHA1:	7E922CCD99CD7758709205E4C9210A2F09F09800
SHA-256:	72992080AA9911184746633C7D6E47570255EE85CC6FE5E843F62331025B2A61
SHA-512:	18290654E5330186B739DEDBC7D6860FD017D089DAE19E480F868E1FB56A3CF2E685D0099C4CF1D4F2AE5F36D0B72ABE52FBAC29AD4F6AB8A45C4C420D90E2D5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Whitehorse) {. {-9223372036854775808 -32412 0 LMT}. {-2188997988 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1

C:\ProgramData\assignee\tcl\tzdata\America\Winnipeg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9379
Entropy (8bit):	3.7354364023000937
Encrypted:	false
SSDEEP:	192:t7K22m2eQ7SRWu3O559BxXWDpws1dwVyUAitGeZiSI0PMnp4ozDCM9LfLPix3QWZ:t7K22m2eQ7Swu3O559BxXWDpws1dwVyU
MD5:	F6B8A2DA74DC3429EC1FAF7A38CB0361
SHA1:	1651AD179DB98C9755CDF17FBFC29EF35DE7F588
SHA-256:	FEAA62063316C8F4AD5FABBF5F2A7DD21812B6658FEC40893657E909DE605317
SHA-512:	46C61EFF429075A77C01AF1C02FD6136529237B30B7F06795BCEE26CDB75DDAB2D418283CD95C9A0140D1510E02F393F0A7E9414C99D1B31301AE213BAF50681
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Winnipeg) {. {-9223372036854775808 -23316 0 LMT}. {-2602258284 -21600 0 CST}. {-1694368800 -18000 1 CDT}. {-1681671600 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1029686400 -18000 1 CDT}. {-1018198800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-746035200 -18000 1 CDT}. {-732733200 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620755200 -18000 1 CDT}. {-607626000 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-

C:\ProgramData\assignee\tcl\tzdata\America\Yakutat

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8407
Entropy (8bit):	3.877915398499678
Encrypted:	false
SSDEEP:	96:ZgOZVKyjVYus/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:ZBZVKH/4h5sBPy+CMt/ElALLVuAH
MD5:	8F3203A395A098A1559DBA8211E507BB
SHA1:	24295E907BB779FB6E606730C0EA804D4FD06609
SHA-256:	2B54CD306F1B99938A1D0926020A569D1D1588A340059DEC1DE61FBFD2A1076C
SHA-512:	CE66B5CCEA8AD706854A03C7FBE3E5EC680FED1F716563566E8357083CCFC4E55795609139E999DAF4F5CD4D88269947FDD1D2E10F68E5DE46D02E67FA5A0046
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yakutat) {. {-9223372036854775808 52865 0 LMT}. {-3225364865 -33535 0 LMT}. {-2188953665 -32400 0 YST}. {-883580400 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-757350000 -32400 0 YST}. {-31503600 -32400 0 YST}. {-21474000 -28800 1 YDT}. {-5752800 -32400 0 YST}. {9975600 -28800 1 YDT}. {25696800 -32400 0 YST}. {41425200 -28800 1 YDT}. {57751200 -32400 0 YST}. {73479600 -28800 1 YDT}. {89200800 -32400 0 YST}. {104929200 -28800 1 YDT}. {120650400 -32400 0 YST}. {126702000 -28800 1 YDT}. {152100000 -32400 0 YST}. {162385200 -28800 1 YDT}. {183549600 -32400 0 YST}. {199278000 -28800 1 YDT}. {215604000 -32400 0 YST}. {230727600 -28800 1 YDT}. {247053600 -32400 0 YST}. {262782000 -28800 1 YDT}. {278503200 -32400 0 YST}. {294231600 -28800 1 YDT}. {309952800 -32400 0 YST}. {325681200

C:\ProgramData\assignee\tcl\tzdata\America\Yellowknife

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7485
Entropy (8bit):	3.785447517514148
Encrypted:	false
SSDEEP:	96:qGzGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:YVUC2mWBNwWTxyWR
MD5:	F7892A95AC025FF42DEAC7DD68E9A1D6
SHA1:	5FDFEB833006620505CE2F0F47C7E0B34319DB3C
SHA-256:	E682009C097E6902595CD860F284E5354DCDD90BE68A19431A40F839B50C42A8
SHA-512:	E186DC91EF45C3DAAA3529C75570D9402EDB529045F1ECB7EA99E74F465E107B63ACABA024CE25DB56387562948BE55DF09FB726D511AB59B81ED646331EF3BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yellowknife) {. {-9223372036854775808 0 0 zzz}. {-1104537600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {68

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Casey

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.635342067673504
Encrypted:	false
SSDEEP:	6:SlSWB9X52L09xvFJm2OHaTQMFuDTKNHATVR:MBp52Lc9mdHaTQMFu3K2TVR
MD5:	6CC1DB82EBBF0D7DF60B01F2AFF9674C
SHA1:	5778B8C36F6D4906B1173FF6BEED90CA0EE65158
SHA-256:	63F6001A9F330A9EF8C28DC9EB003C216BA3799ADE5404EC23FA77049F801208
SHA-512:	6CDC5D309AD237CF2B85E3A9AB47FFE153826C14862B25C8C76256F1D5531E2511A1330E3D1F9FB52EF0674080258EB99D934B82335C9AC3C8B1487868B43E12
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Casey) {. {-9223372036854775808 0 0 zzz}. {-31536000 28800 0 WST}. {1255802400 39600 0 CAST}. {1267714800 28800 0 WST}. {1319738400 39600 0 CAST}. {1329843600 28800 0 WST}.}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Davis

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.486342929628561
Encrypted:	false
SSDEEP:	6:SlSWB9X52L0DTm2OHaRwz0/ePX7VoX/eyfyRXhNXSeOC/ed:MBp52LeTmdHaKxXODaRRF+
MD5:	BA37E2A48529496C9EBA7E416591C644
SHA1:	AD1C15A0E84C10EBDE9F0404DF969B2EE14CB18E
SHA-256:	B17ABA536140CE822CD14845BD92E85FA1D36CD3AE36F993B99535EA95BACF96
SHA-512:	B96A5324F1D0F25F5518737C8C3B942B9D1A0E626CDC6463F973928AEB0A53EB2C7A65E90C3305E9898220AB582CE3C89943A46605EADC4E4A99309D64B73071
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Davis) {. {-9223372036854775808 0 0 zzz}. {-409190400 25200 0 DAVT}. {-163062000 0 0 zzz}. {-28857600 25200 0 DAVT}. {1255806000 18000 0 DAVT}. {1268251200 25200 0 DAVT}. {1319742000 18000 0 DAVT}. {1329854400 25200 0 DAVT}.}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\DumontDUrville

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.841687980121893
Encrypted:	false
SSDEEP:	6:SlSWB9X52L0/3Om2OHajRX8azcJRJ6SXeKn:MBp52LdmdHajx8azkkK
MD5:	E4CD713CC96B408C1AF1128EE19C2683
SHA1:	E431DF0AF88DDAEB69B563BD2B75CCAC859DC66E
SHA-256:	415711270E2FB8F3DE8ABEF98E51810445520D6FFA9A384AC9C0973324CE9DA6
SHA-512:	420D8F397CB8B9BED0DCFA69B68FEF7A0B66AE6169FB3D40C9360EA2A86C6210225880E2CD000C468AF5B52B19A2B74E0E1D7ABB0AB6F05F9B2AE9D9C020DEC0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/DumontDUrville) {. {-9223372036854775808 0 0 zzz}. {-725846400 36000 0 PMT}. {-566992800 0 0 zzz}. {-415497600 36000 0 DDUT}.}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Macquarie

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	3.7678874480827362
Encrypted:	false
SSDEEP:	24:cQbTeU9U27sxijlil/iBq8DSmKP0BRke5VXyDouBtfpBFg87kniITjx:5dHYsiB8mfPuKgXyDDkVTd
MD5:	E819C7A5D5E4F6ECDA576F9E15E9F801
SHA1:	F8184CCF599B48499B9351467CAE493C14800A67
SHA-256:	0CE7410CFBF89B41E2DF7970BD67F66E84F2BC1FE8247403E6B1B0C22DD07FD3
SHA-512:	355DBB7C384E060DA09D488CDC16230B6CD07C8B7D68E3656B9D3F41331165C4C4A37A0267EB77DD9F2B70D21B28CD6F5EB870D4B952405C1B096F29682465C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Macquarie) {. {-9223372036854775808 0 0 zzz}. {-2214259200 36000 0 EST}. {-1680508800 39600 1 EST}. {-1669892400 39600 0 EST}. {-1665392400 36000 0 EST}. {-1601719200 0 0 zzz}. {-94730400 36000 0 EST}. {-71136000 39600 1 EST}. {-55411200 36000 0 EST}. {-37267200 39600 1 EST}. {-25776000 36000 0 EST}. {-5817600 39600 1 EST}. {5673600 36000 0 EST}. {25632000 39600 1 EST}. {37728000 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {89136000 39600 1 EST}. {100022400 36000 0 EST}. {120585600 39600 1 EST}. {131472000 36000 0 EST}. {152035200 39600 1 EST}. {162921600 36000 0 EST}. {183484800 39600 1 EST}. {194976000 36000 0 EST}. {215539200 39600 1 EST}. {226425600 36000 0 EST}. {246988800 39600 1 EST}. {257875200 36000 0 EST}. {278438400 39600 1 EST}. {289324800 36000 0 EST}. {309888000 39600 1 EST}. {320774400 360

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Mawson

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.828936781959796
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEzyedFkXGm2OHv/fCF/mVU/VPKVVFUysvUXS7tvn:SlSWB9X52L0zyEm2OHary/3sZBn
MD5:	78B2CE32973FB9701B7FE487B082941A
SHA1:	1A056555E64B2C7F7926B6A7F043049A2E93150D
SHA-256:	29472C5FAE7149AE3BC007D0BE4D1B1975E46F3BB77434832467C1326DF90AE2
SHA-512:	FD7DF0F9913A0E77F9F53F954A9EA16D616334DED7BAA41B1D54990C6458FFFB70CF2D5204288AD430833FFA36E22247144C4E624AEC1FF215EA79D92232869E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Mawson) {. {-9223372036854775808 0 0 zzz}. {-501206400 21600 0 MAWT}. {1255809600 18000 0 MAWT}.}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\McMurdo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7622
Entropy (8bit):	3.8026377608298607
Encrypted:	false
SSDEEP:	96:f7nBIc0fw4eJ7a1N1oKe13aNiWbF8sYBpYhuVn:fmc3J7a1N18QOs8
MD5:	B5FE072BBD26A6FA829CC92CA6031281
SHA1:	5D2E795065E9F8BF9420CE1C8C426C666B199EB8
SHA-256:	B0940B34E8263B390F663918407CDC210BA19EEF18DAB35A08268EA693514665
SHA-512:	A8F8A5112309D732257A3FB867BF6C6939F3CAA100D34B11EC2B0EE1320CE5334552FDC55A0273226B8A8A3CE03D9123C1FC79589BA18A57F2B226AC69DEE5EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/McMurdo) {. {-9223372036854775808 0 0 zzz}. {-441849600 43200 0 NZST}. {152632800 46800 1 NZDT}. {162309600 43200 0 NZST}. {183477600 46800 1 NZDT}. {194968800 43200 0 NZST}. {215532000 46800 1 NZDT}. {226418400 43200 0 NZST}. {246981600 46800 1 NZDT}. {257868000 43200 0 NZST}. {278431200 46800 1 NZDT}. {289317600 43200 0 NZST}. {309880800 46800 1 NZDT}. {320767200 43200 0 NZST}. {341330400 46800 1 NZDT}. {352216800 43200 0 NZST}. {372780000 46800 1 NZDT}. {384271200 43200 0 NZST}. {404834400 46800 1 NZDT}. {415720800 43200 0 NZST}. {436284000 46800 1 NZDT}. {447170400 43200 0 NZST}. {467733600 46800 1 NZDT}. {478620000 43200 0 NZST}. {499183200 46800 1 NZDT}. {510069600 43200 0 NZST}. {530632800 46800 1 NZDT}. {541519200 43200 0 NZST}. {562082400 46800 1 NZDT}. {573573600 43200 0 NZST}. {594136800 46800 1 NZDT}. {605023200

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Palmer

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7659
Entropy (8bit):	3.7915977499977096
Encrypted:	false
SSDEEP:	192:a+JjG3dUUugM981gh+tLIzx6z31ho1VmTfE3rZZ1LqdkG7xd28y+j2TjMjjInyWj:aPpf2RsU
MD5:	7C105A8876F32A4906DA75FC4B5D32D9
SHA1:	8A8BF10D2693A23779A601FA5ECE7C213D8D1E1E
SHA-256:	C6771DC4BF2D1BC7059B64182C6D8FE2897751778F1A6636BDFF49190472E8EC
SHA-512:	81E287B9ADFC703C91D7D04316D13351F08E89E6BF75652E9F31EB5B8D62F4F9C072CB03BF831FF972A997DA7524B924EB4F5D3997B4059CD4735446847C8000
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Palmer) {. {-9223372036854775808 0 0 zzz}. {-157766400 -14400 0 ART}. {-152654400 -14400 0 ART}. {-132955200 -10800 1 ARST}. {-121122000 -14400 0 ART}. {-101419200 -10800 1 ARST}. {-86821200 -14400 0 ART}. {-71092800 -10800 1 ARST}. {-54766800 -14400 0 ART}. {-39038400 -10800 1 ARST}. {-23317200 -14400 0 ART}. {-7588800 -10800 0 ART}. {128142000 -7200 1 ARST}. {136605600 -10800 0 ART}. {389070000 -14400 0 CLT}. {403070400 -10800 1 CLST}. {416372400 -14400 0 CLT}. {434520000 -10800 1 CLST}. {447822000 -14400 0 CLT}. {466574400 -10800 1 CLST}. {479271600 -14400 0 CLT}. {498024000 -10800 1 CLST}. {510721200 -14400 0 CLT}. {529473600 -10800 1 CLST}. {545194800 -14400 0 CLT}. {560923200 -10800 1 CLST}. {574225200 -14400 0 CLT}. {591768000 -10800 1 CLST}. {605674800 -14400 0 CLT}. {624427200 -10800 1 CLST}. {637729200 -14400 0 CLT}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Rothera

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.897451485949667
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEsKRaXGm2OHv/fCF/F/H3VVFVtC:SlSWB9X52L0rRhm2OHa//VVF7C
MD5:	D0D77DD1FC371697C5C41A84CCA4C362
SHA1:	1EE9D25A49B17B384F459E48E48626ED2529FDAA
SHA-256:	099ECC8A06D74A92758F619AED115F42F490D0AC515568D7308DDD29AE148503
SHA-512:	0BDFDA36EC0F16511CDBDA2A938944081ECA746755175C12C09F6CCCA83F449A922DAF18268E17BA3D3DE8319C21152A39EB26AB6CA855F0C18A9263086BE0ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Rothera) {. {-9223372036854775808 0 0 zzz}. {218246400 -10800 0 ROTT}.}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\South_Pole

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.807055248079355
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y16zyVAIgz6O62L0tlo+p4L0z6t:MBaIM9S2LMq+p4Lx
MD5:	FFEA1D1DBF48DAC6100EA2C159970EA3
SHA1:	1DFEB24F91BEE218EBDDD412AC2588C2E2A06842
SHA-256:	B641256D1E0281E006A3EDB9CD2BC5DEC124FF5DC62653EB4199D4196470D343
SHA-512:	352483E1D1DC50B664C1F34BF70738533FD325E1F61B148CD89580CA6CA0B5CDEF73DE96D877A93ACB30CA497273931044DA90F09E6B5534272B07D1621912D6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Antarctica/McMurdo)]} {. LoadTimeZoneFile Antarctica/McMurdo.}.set TZData(:Antarctica/South_Pole) $TZData(:Antarctica/McMurdo).

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Syowa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.870240083017443
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEtWlFeEXGm2OHv/fCF/noMdMbv:SlSWB9X52L0tQeLm2OHaRbK
MD5:	ECA41775A0B086F9793055251447D1A8
SHA1:	7D760E1811F5893122659434E2B2DA0128210D6E
SHA-256:	6372A7C104A8C5A49F223F78909201A8BEB6A4A494D56FE3EE075481E6F4A3A8
SHA-512:	48428C664D224AA6D140EE085C889821F7A4558BA55E6563EC22DCBE4BB96DAEA3ECFFDA607211EFC763FB17B940C91679698049D57E980ABCC0201E442AFCB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Syowa) {. {-9223372036854775808 0 0 zzz}. {-407808000 10800 0 SYOT}.}.

C:\ProgramData\assignee\tcl\tzdata\Antarctica\Vostok

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.889998800024563
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEoKcMFtXGm2OHv/fCF/gd/bVFXKVVFJtvn:SlSWB9X52L0XcMFEm2OHaqVFXK/Nn
MD5:	A75528ECB73AA4F1A40182E54C69246C
SHA1:	390AE655C44523ABBC4D84925E84795F2822FA6B
SHA-256:	53C302E681EDFCBE0A0B757DEC7A1E0CA584E2D8A5EE3D4BFDBEBE4C71AEE02A
SHA-512:	7ABEBEDE35059F6AB73DB952475D94E7D76AC1A433C6E3568262AD84ABF92B24B3E3D5FE373709D35079E74379BBC77B8C19D2DF7CC852239294717FFAE758C9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Vostok) {. {-9223372036854775808 0 0 zzz}. {-380073600 21600 0 VOST}.}.

C:\ProgramData\assignee\tcl\tzdata\Arctic\Longyearbyen

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.922114908130109
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2XbeLo4cA4FH/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2XbUyAK8H
MD5:	0F69284483D337DC8202970461A28386
SHA1:	0D4592B8EBE070119CB3308534FE9A07A758F309
SHA-256:	3A5DB7C2C71F95C495D0884001F82599E794118452E2748E95A7565523546A8E
SHA-512:	D9F2618B153BFE4888E893A62128BE0BD59DFAFC824DA629454D5D541A9789536AC029BF73B6E9749409C522F450D53A270D302B2CF084444EA64D9138D77DFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo).

C:\ProgramData\assignee\tcl\tzdata\Asia\Aden

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.921606277899897
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKzFkXGm2OH8vvToJWVVvwvYv:SlSWB9X52wKlm2OH8vLoIVV
MD5:	B5AE25B0A567A7BF1E4FE66243C7A452
SHA1:	D8281C28B4226E1614A66BF8CE9E04F071DA205A
SHA-256:	E49C7E468587FC88D2B4FAF72AD0F37DE15391D349F6049EA48622DBF7E8E5D1
SHA-512:	B87FFF120BC1A24DE31C184049CA28301BA32C433D510F02EB1034BFB53BD6335553FE52F2CDFD0FCE2C5D502FDA7CB43690760DD515E42293DD33923F162506
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aden) {. {-9223372036854775808 10794 0 LMT}. {-631162794 10800 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Almaty

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1627
Entropy (8bit):	3.956903784715755
Encrypted:	false
SSDEEP:	48:5CeyeBebweJq7eqeS7eWqeUeVerePwehe0eNNeGeIOeoe4eieV7epeGqeUeuecea:R74bxTDpWDF8C5YlNkvIH5JrQwGDFn9a
MD5:	CC9C35479B78031C20B1E7BB17DBC970
SHA1:	9E5D894B8B50466F2FFEA9F6AF3022BEDDE8A8CA
SHA-256:	CFF6D1A1EB22F1F425C996F18427F96B3920D945A0EAF028D752A5717CC4A588
SHA-512:	ADD0CF752F0B00C4894EA7A8475D3A1F01CEF3195A6F09993508BB006C1B0F74FB4AA56F0D4D6756D9BAAAB1995F89B8C75D2178284F21AA11286B5B2378FEE7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Almaty) {. {-9223372036854775808 18468 0 LMT}. {-1441170468 18000 0 ALMT}. {-1247547600 21600 0 ALMT}. {354909600 25200 1 ALMST}. {370717200 21600 0 ALMT}. {386445600 25200 1 ALMST}. {402253200 21600 0 ALMT}. {417981600 25200 1 ALMST}. {433789200 21600 0 ALMT}. {449604000 25200 1 ALMST}. {465336000 21600 0 ALMT}. {481060800 25200 1 ALMST}. {496785600 21600 0 ALMT}. {512510400 25200 1 ALMST}. {528235200 21600 0 ALMT}. {543960000 25200 1 ALMST}. {559684800 21600 0 ALMT}. {575409600 25200 1 ALMST}. {591134400 21600 0 ALMT}. {606859200 25200 1 ALMST}. {622584000 21600 0 ALMT}. {638308800 25200 1 ALMST}. {654638400 21600 0 ALMT}. {662666400 21600 0 ALMT}. {694202400 21600 0 ALMT}. {701802000 25200 1 ALMST}. {717523200 21600 0 ALMT}. {733262400 25200 1 ALMST}. {748987200 21600 0 ALMT}. {764712000 25200 1 ALMST}. {780436800 21600 0 ALMT}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Amman

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7085
Entropy (8bit):	3.6214039838482117
Encrypted:	false
SSDEEP:	96:Rnv8A4XkyKfUN9QX4kFpej4g2uMekzdgyvwKVuKEZhfuITrar2gsq0teU:RvMw2yZp+4g2PxbLS5
MD5:	3F233E9C8DFD54121C4B3962B7E0EFE0
SHA1:	47B71500F158E0C84F642A2A1D0179F7D05DE406
SHA-256:	55487242457983A1157FA9EEE2FAF0B2F2B0402F8E15340314227CA9995228D0
SHA-512:	CC1AF2CFF1F1413CAF998DBD1CEF3430E19B36886089445E5185847AD75F89EFD39856F72071B38DB5C5687AAC7E254CF6C92598DDCD821CC70AB0FF38BF57EE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Amman) {. {-9223372036854775808 8624 0 LMT}. {-1230776624 7200 0 EET}. {108165600 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {215643600 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EET}. {262735200 10800 1 EEST}. {275950800 7200 0 EET}. {481154400 10800 1 EEST}. {496962000 7200 0 EET}. {512949600 10800 1 EEST}. {528670800 7200 0 EET}. {544399200 10800 1 EEST}. {560120400 7200 0 EET}. {575848800 10800 1 EEST}. {592174800 7200 0 EET}. {610581600 10800 1 EEST}. {623624400 7200 0 EET}. {641167200 10800 1 EEST}. {655074000 7200 0 EET}. {671839200 10800 1 EEST}. {685918800 7200 0 EET}. {702856800 10800 1 EEST}. {717973200 7200 0 EET}. {733701600 10800 1 EEST}. {749422800 7200 0 EET}. {765151200 10800 1

C:\ProgramData\assignee\tcl\tzdata\Asia\Anadyr

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	3.9059727754043094
Encrypted:	false
SSDEEP:	48:5l1wikTTFLDQg/c1l9U7z/viKX2jO61kd9Outd1rq92Eb6LqeJ3f686bzQ:71wikHFNiKX2jAwIvUs
MD5:	C8D90F85B9D4DBE3D8C0C0034703A5A0
SHA1:	F38B93DABD7F96EBC21F854F782709ECE7AE2867
SHA-256:	89D9194E2CC512F5AD13C4081DF3BE8FEA893B97BDD2483155A88BF481397CCE
SHA-512:	1B85DA900D0E34E7127E238150CE15491713C5261AA2523E049C16CDD6CAB854FB2A506AFC8B27F3D1178FEE74B997743019C973454368DBDDFA2488D2340E56
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Anadyr) {. {-9223372036854775808 42596 0 LMT}. {-1441194596 43200 0 ANAT}. {-1247572800 46800 0 ANAMMTT}. {354884400 50400 1 ANAST}. {370692000 46800 0 ANAT}. {386420400 43200 0 ANAMMTT}. {386424000 46800 1 ANAST}. {402231600 43200 0 ANAT}. {417960000 46800 1 ANAST}. {433767600 43200 0 ANAT}. {449582400 46800 1 ANAST}. {465314400 43200 0 ANAT}. {481039200 46800 1 ANAST}. {496764000 43200 0 ANAT}. {512488800 46800 1 ANAST}. {528213600 43200 0 ANAT}. {543938400 46800 1 ANAST}. {559663200 43200 0 ANAT}. {575388000 46800 1 ANAST}. {591112800 43200 0 ANAT}. {606837600 46800 1 ANAST}. {622562400 43200 0 ANAT}. {638287200 46800 1 ANAST}. {654616800 43200 0 ANAT}. {670341600 39600 0 ANAMMTT}. {670345200 43200 1 ANAST}. {686070000 39600 0 ANAT}. {695746800 43200 0 ANAMMTT}. {701780400 46800 1 ANAST}. {717501600 43200 0 ANAT}. {733240800 46800

C:\ProgramData\assignee\tcl\tzdata\Asia\Aqtau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1684
Entropy (8bit):	3.971554616694357
Encrypted:	false
SSDEEP:	24:cQJeoR910JIhf6ZZKIYOdaV2K7LOtadYOWbgqwecyXE0uU914QlLY8uaX6:5XAIhf6KINmB21aN
MD5:	F57B92336C0F84BEF426E8A3D472C9B1
SHA1:	3269B8E9E0593A3D40761526D737FD4FFF55F052
SHA-256:	D89D07789291AA562A5080603D9D65AE3F1DE4B430737177747A8FCCFE61EC4B
SHA-512:	7ED92CCA7263B4492161EC8F2E6FD91EDE70A84BA660C6A3A0FDBD6554D80B993E57419AE3842E0E29380F1EAAEEAB96633B2F1443D82008FBC160F1F98308C0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtau) {. {-9223372036854775808 12064 0 LMT}. {-1441164064 14400 0 FORT}. {-1247544000 18000 0 FORT}. {-220942800 18000 0 SHET}. {370724400 21600 0 SHET}. {386445600 18000 0 SHET}. {386449200 21600 1 SHEST}. {402256800 18000 0 SHET}. {417985200 21600 1 SHEST}. {433792800 18000 0 SHET}. {449607600 21600 1 SHEST}. {465339600 18000 0 SHET}. {481064400 21600 1 SHEST}. {496789200 18000 0 SHET}. {512514000 21600 1 SHEST}. {528238800 18000 0 SHET}. {543963600 21600 1 SHEST}. {559688400 18000 0 SHET}. {575413200 21600 1 SHEST}. {591138000 18000 0 SHET}. {606862800 21600 1 SHEST}. {622587600 18000 0 SHET}. {638312400 21600 1 SHEST}. {654642000 18000 0 SHET}. {662670000 18000 0 SHET}. {692823600 18000 0 AQTT}. {701805600 21600 1 AQTST}. {717526800 18000 0 AQTT}. {733266000 21600 1 AQTST}. {748990800 18000 0 AQTT}. {764715600 21600 1 AQTST}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Aqtobe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	3.8964942154031177
Encrypted:	false
SSDEEP:	24:cQFLeAQkaIz7c7hGQERlP9oIfgy+4d6X5rfMKBvLO913bIwnzC4:5FGIz7c7hGQERpSIfB+Q6X9fDBS3b
MD5:	EEF32CC834FADB107C645CC5B036298A
SHA1:	770DE2AC8995F7AF012D6CD3A269FEBEE5965289
SHA-256:	1732062E5FEEAE6EE22F9D31B932DB32D373C29471917BC8CA9B37F008AAA531
SHA-512:	41E8E1A7947B5A9522746ACF98ED4C8DBF195ABB7F91A3F250ACFE2643F1A76B9A528FC29D6B0BFFE50AEA2865DAA2C5CC60238A23949A76B146324AE245EFEE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtobe) {. {-9223372036854775808 13720 0 LMT}. {-1441165720 14400 0 AKTT}. {-1247544000 18000 0 AKTT}. {354913200 21600 1 AKTST}. {370720800 21600 0 AKTT}. {386445600 18000 0 AKTT}. {386449200 21600 1 AKTST}. {402256800 18000 0 AKTT}. {417985200 21600 1 AKTST}. {433792800 18000 0 AKTT}. {449607600 21600 1 AKTST}. {465339600 18000 0 AKTT}. {481064400 21600 1 AKTST}. {496789200 18000 0 AKTT}. {512514000 21600 1 AKTST}. {528238800 18000 0 AKTT}. {543963600 21600 1 AKTST}. {559688400 18000 0 AKTT}. {575413200 21600 1 AKTST}. {591138000 18000 0 AKTT}. {606862800 21600 1 AKTST}. {622587600 18000 0 AKTT}. {638312400 21600 1 AKTST}. {654642000 18000 0 AKTT}. {662670000 18000 0 AKTT}. {692823600 18000 0 AQTT}. {701805600 21600 1 AQTST}. {717526800 18000 0 AQTT}. {733266000 21600 1 AQTST}. {748990800 18000 0 AQTT}. {764715600 21600 1 AQTST}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Ashgabat

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.093280687935826
Encrypted:	false
SSDEEP:	12:MBp52gZmdHRV9IDOo3sjkhWF47ZKUjfmWnmjQIyhxdtrsjmWdjDe2WZlyXToDX3A:cQgZeRHIMwhXwb1kIw6do3kToT3CPV
MD5:	9E1A83332FA045AAF785B8956DE331B2
SHA1:	6228E8B105D8052D64D7C9965D1624F629D5E2DD
SHA-256:	D8222AEB02E04141B35FDE9CF957422E40AF7611D7814A624AD2395E7EF5799C
SHA-512:	7E7BA6DDD3A79DB1C912E0898DDA22DDDD9ABE6EAE5667268BC18BD2993995598C9CDFF7104ACAC1C8A28B5BDCA90734808ED1687371693BF9922195658A3A15
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ashgabat) {. {-9223372036854775808 14012 0 LMT}. {-1441166012 14400 0 ASHT}. {-1247544000 18000 0 ASHT}. {354913200 21600 1 ASHST}. {370720800 18000 0 ASHT}. {386449200 21600 1 ASHST}. {402256800 18000 0 ASHT}. {417985200 21600 1 ASHST}. {433792800 18000 0 ASHT}. {449607600 21600 1 ASHST}. {465339600 18000 0 ASHT}. {481064400 21600 1 ASHST}. {496789200 18000 0 ASHT}. {512514000 21600 1 ASHST}. {528238800 18000 0 ASHT}. {543963600 21600 1 ASHST}. {559688400 18000 0 ASHT}. {575413200 21600 1 ASHST}. {591138000 18000 0 ASHT}. {606862800 21600 1 ASHST}. {622587600 18000 0 ASHT}. {638312400 21600 1 ASHST}. {654642000 18000 0 ASHT}. {670366800 14400 0 ASHT}. {670370400 18000 1 ASHST}. {686095200 14400 0 ASHT}. {695772000 18000 0 TMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Ashkhabad

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.750782589043179
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8xEYM4DdVAIgN/ZEYvCHt2WFKUNSH+WFKYEYMvn:SlSWB9IZaM3yRhVAIgH1CHt2wKUNSewa
MD5:	73E1F618FB430C503A1499E3A0298C97
SHA1:	29F31A7C9992F9D9B3447FCBC878F1AF8E4BD57F
SHA-256:	5917FC603270C0470D2EC416E6C85E999A52B6A384A2E1C5CFC41B29ABCA963A
SHA-512:	FAE39F158A4F47B4C37277A1DC77B8524DD4287EBAD5D8E6CBB906184E6DA275A308B55051114F4CD4908B449AE3C8FD48384271E3F7106801AD765E5958B4DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ashgabat)]} {. LoadTimeZoneFile Asia/Ashgabat.}.set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat).

C:\ProgramData\assignee\tcl\tzdata\Asia\Baghdad

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	3.8265567749629983
Encrypted:	false
SSDEEP:	24:cQcTe0yFHi6Uf4DUfKUfKmF7mUffcqbUfgNqcUfZUfKUfAaUfaMZUflCUfzbS/UY:5cpmpPmFrLNquvStD1XJtgCx
MD5:	7A1020270EA06F2E77AC92F960A6D389
SHA1:	DD47A64D16E9E95FE42650B38AAC422E011EF51F
SHA-256:	C15E1710D2287D9D05D22F8F594BBFDAC8C890F84DCADB4EB833177FE4B27627
SHA-512:	C654A32D668121CE4F6D041520CD588E10698DAF85BF187C2FCB97FB0982934D7C4A252A2044ED806828F5EC4713652C5F45B22B3A22073DAD9897097BD4652B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baghdad) {. {-9223372036854775808 10660 0 LMT}. {-2524532260 10656 0 BMT}. {-1641005856 10800 0 AST}. {389048400 14400 0 ADT}. {402264000 10800 0 AST}. {417906000 14400 1 ADT}. {433800000 10800 0 AST}. {449614800 14400 1 ADT}. {465422400 10800 0 AST}. {481150800 14400 1 ADT}. {496792800 10800 0 AST}. {512517600 14400 1 ADT}. {528242400 10800 0 AST}. {543967200 14400 1 ADT}. {559692000 10800 0 AST}. {575416800 14400 1 ADT}. {591141600 10800 0 AST}. {606866400 14400 1 ADT}. {622591200 10800 0 AST}. {638316000 14400 1 ADT}. {654645600 10800 0 AST}. {670464000 14400 1 ADT}. {686275200 10800 0 AST}. {702086400 14400 1 ADT}. {717897600 10800 0 AST}. {733622400 14400 1 ADT}. {749433600 10800 0 AST}. {765158400 14400 1 ADT}. {780969600 10800 0 AST}. {796694400 14400 1 ADT}. {812505600 10800 0 AST}. {828316800 14400 1 ADT}. {844128000 1

C:\ProgramData\assignee\tcl\tzdata\Asia\Bahrain

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.877533718022302
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKENUKMFeHkXGm2OHlpoevUQKCebVVGF5FRVGwvYv:SlSWB9X52wKENUSm2OHlGeRwzGfFRVS
MD5:	466B4C86DE92AD98141F5D3076CF9E8C
SHA1:	C19DC60C48EC39F621293CF52A9ACE5B676A09DF
SHA-256:	1029EE833063C9BB4B606222843A693814F255540D53299FA904FC969B1D6D1A
SHA-512:	3065DA8B197EA8D9BD82F9EB1CDEF96B445054068DFA45000ECB0981E2FBD8FB2CFF002F22B3FAADC04BBE3554377FBC7A15A6801B63642C54AD8490BB613F99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bahrain) {. {-9223372036854775808 12140 0 LMT}. {-1577935340 14400 0 GST}. {76190400 10800 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Baku

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7087
Entropy (8bit):	3.7112129677911785
Encrypted:	false
SSDEEP:	96:7CbMFbN5FMhBnLT9Eb82WFddWqgYL2WCQotwY2hssmC1j+IqgzbiSjMAL3Bd8:7nFXFKBdEb82WFddfgYMQUwYpCuW3Bq
MD5:	D5493186CFA8CBA38FEF6CB2B8D58F66
SHA1:	6FE30365F3BADC12337E62387D2DC5D1590E462B
SHA-256:	1442701FDDE072F3ED533586A641ECBB1EAF5930DF57C4D170910B2403678C09
SHA-512:	CED2D4C1B69EF46968E81AA7BFC8177425FB63AE2B8DBEDC71A3F3A428EB7DB08AC72F240CEEC951B1A00FCD64922B104CD7A564FA7A966AA3C3BAEC75E516B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baku) {. {-9223372036854775808 11964 0 LMT}. {-1441163964 10800 0 BAKT}. {-405140400 14400 0 BAKT}. {354916800 18000 1 BAKST}. {370724400 14400 0 BAKT}. {386452800 18000 1 BAKST}. {402260400 14400 0 BAKT}. {417988800 18000 1 BAKST}. {433796400 14400 0 BAKT}. {449611200 18000 1 BAKST}. {465343200 14400 0 BAKT}. {481068000 18000 1 BAKST}. {496792800 14400 0 BAKT}. {512517600 18000 1 BAKST}. {528242400 14400 0 BAKT}. {543967200 18000 1 BAKST}. {559692000 14400 0 BAKT}. {575416800 18000 1 BAKST}. {591141600 14400 0 BAKT}. {606866400 18000 1 BAKST}. {622591200 14400 0 BAKT}. {638316000 18000 1 BAKST}. {654645600 14400 0 BAKT}. {670370400 14400 1 BAKST}. {683496000 14400 0 AZST}. {686098800 10800 0 AZT}. {701812800 14400 1 AZST}. {717537600 14400 0 AZT}. {820440000 14400 0 AZT}. {828234000 18000 1 AZST}. {846378000 14400 0 AZT}. {852062

C:\ProgramData\assignee\tcl\tzdata\Asia\Bangkok

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.870101193174299
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKELYOUXGm2OHB+kevXZKmrROpDvFFsQ+8EXV8GCCn:SlSWB9X52wKELPm2OHxePZ3FO1Rb+2GL
MD5:	9547C9173AA853C298ECEEFD6CB66A7C
SHA1:	B9A17A14F652E3C22AE9552F93F0C7F8EE5E8444
SHA-256:	BE7B9D93A7EF23A2EF6CC90AB85001B66E4D37F314FFCEA0E36A4E1F625D1DDD
SHA-512:	FB984DC7DA388F68437545560AF0CE0952474C72811673DCBC4EC73BFEC4E7A985F459BDB3D5EF47A83B0731D203AF1F66D8DBD13CB8B3ED6A4041E7C2165E43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bangkok) {. {-9223372036854775808 24124 0 LMT}. {-2840164924 24124 0 BMT}. {-1570084924 25200 0 ICT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Beirut

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7754
Entropy (8bit):	3.6329631010207892
Encrypted:	false
SSDEEP:	96:OnQv8iPC28v82K/w1VxDmsCZgV+f7dIWDkLDo1WlqCTpXxcKvjRQZwtPEWRTvS4y:OQjPCL5VxKWC7dIWDkLDoqphsX
MD5:	2D3AE4AD36BD5F302F980EB5F1DD0E4A
SHA1:	02244056D6D4EC57937D1E187CC65E8FD18F67F0
SHA-256:	E9DD371FA47F8EF1BE04109F0FD3EBD9FC5E2B0A12C0630CDD20099C838CBEBB
SHA-512:	2E4528254102210B8A9A2263A8A8E72774D40F57C2431C2DD6B1761CD91FB6CEA1FAD23877E1E2D86217609882F3605D7FE477B771A398F91F8D8AD3EAF90BAC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Beirut) {. {-9223372036854775808 8520 0 LMT}. {-2840149320 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1473645600 10800 1 EEST}. {-1460948400 7200 0 EET}. {-399866400 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336794400 10800 1 EEST}. {-323578800 7200 0 EET}. {-305172000 10800 1 EEST}. {-291956400 7200 0 EET}. {-273636000 10800 1 EEST}. {-260420400 7200 0 EET}. {78012000 10800 1 EEST}. {86734800 7200 0 EET}. {105055200 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {212965200 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EE

C:\ProgramData\assignee\tcl\tzdata\Asia\Bishkek

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1631
Entropy (8bit):	4.017458953208438
Encrypted:	false
SSDEEP:	24:cQge4ay42FChvqp7DzghGjwTwKcVVTHTiTiyU2oWUooOp:5wSqVXx7uRRp
MD5:	65B8BDCB642E932AD2D503C7241177A7
SHA1:	EA0D787E4A6DE96A7346EA91FA3612D4EFE74B41
SHA-256:	EC8F9DAEB039FA1E40FF2A80001B35DEFA0FEDBC5F0A9B451339FAC5250BC91F
SHA-512:	50152255EF633D90F5E11AC9F17C6CAD6F0E32FDF71ACFED6C18D3F4FD382EC0925E1A5717022B2722848598466CA20DC8A86F4FF639A631B839069729DB6DBA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bishkek) {. {-9223372036854775808 17904 0 LMT}. {-1441169904 18000 0 FRUT}. {-1247547600 21600 0 FRUT}. {354909600 25200 1 FRUST}. {370717200 21600 0 FRUT}. {386445600 25200 1 FRUST}. {402253200 21600 0 FRUT}. {417981600 25200 1 FRUST}. {433789200 21600 0 FRUT}. {449604000 25200 1 FRUST}. {465336000 21600 0 FRUT}. {481060800 25200 1 FRUST}. {496785600 21600 0 FRUT}. {512510400 25200 1 FRUST}. {528235200 21600 0 FRUT}. {543960000 25200 1 FRUST}. {559684800 21600 0 FRUT}. {575409600 25200 1 FRUST}. {591134400 21600 0 FRUT}. {606859200 25200 1 FRUST}. {622584000 21600 0 FRUT}. {638308800 25200 1 FRUST}. {654638400 21600 0 FRUT}. {670363200 21600 1 FRUST}. {683582400 21600 0 KGT}. {703018800 21600 1 KGST}. {717530400 18000 0 KGT}. {734468400 21600 1 KGST}. {748980000 18000 0 KGT}. {765918000 21600 1 KGST}. {780429600 18000 0 KGT}. {79

C:\ProgramData\assignee\tcl\tzdata\Asia\Brunei

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.8522836687190525
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKXeAMMkEXGm2OHCQdvVVvUWUOVFW/FvnCHFiUMWfV1vVwK:SlSWB9X52wK0bm2OHCIvVVXUuW/oH1M4
MD5:	FE466A14AEBD47A272FEF267BBBE9D2F
SHA1:	1F774A7F7B7555BD2E8B7B3795046B8D6D42A6E6
SHA-256:	9339F71384B466EA9A5210D84EABBEC5EB61DEAA0689589804999B3EA34FD1B4
SHA-512:	C14A29D9EE5C4DBEDDE7B1E5ADD6B4080E274B9ED4550F987DCC6E6DC7EB3949A7441220CE5B50CCFA9EB0002427634E85D554ECCE8FDF695933DC3F51AE9CEE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Brunei) {. {-9223372036854775808 27580 0 LMT}. {-1383464380 27000 0 BNT}. {-1167636600 28800 0 BNT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Calcutta

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.721946029615065
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq864DdVAIgN1EF2WFKh0s+WFKvvn:SlSWB9IZaM3ya4DdVAIgo2wKN+wKvv
MD5:	A967F010A398CD98871E1FF97F3E48AC
SHA1:	6C8C0AF614D6789CD1F9B6243D26FAC1F9B767EF
SHA-256:	B07250CD907CA11FE1C94F1DCCC999CECF8E9969F74442A9FCC00FC48EDE468B
SHA-512:	67E3207C8A63A5D8A1B7ED1A62D57639D695F9CD83126EB58A70EF076B816EC5C4FDBD23F1F32A4BB6F0F9131D30AF16B56CD92B1C42C240FD886C81BA8940DA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kolkata)]} {. LoadTimeZoneFile Asia/Kolkata.}.set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata).

C:\ProgramData\assignee\tcl\tzdata\Asia\Choibalsan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1486
Entropy (8bit):	4.021028316188265
Encrypted:	false
SSDEEP:	24:cQtZeCjDsGtyoXod+nqoNozomqod1oqoacvWjog2lzoBoAa8odzoIouPZomoFyoS:5tFAGp4g7yUm7dy7RvWkg2lUuA2GVuP5
MD5:	8F99BCC6813A4F47A14F3A23B0457274
SHA1:	1DB31FE9CE4AB6215853E22C00E7D51213939C87
SHA-256:	38BA1C9D0A9E7052D996D4642AE9A6945C51774D8EFA3E4D8870D2ABBDC48689
SHA-512:	AF762A7308E25C52C4F57274659D612CA1CA1EBC4AC79B55FE1F3BBCAE66AFEE8CE329A2F19BFC1DC7D4525FAEF3A17A53207ED2EB0C196450EF36CD5CB81080
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Choibalsan) {. {-9223372036854775808 27480 0 LMT}. {-2032933080 25200 0 ULAT}. {252435600 28800 0 ULAT}. {417974400 36000 0 CHOST}. {433778400 32400 0 CHOT}. {449593200 36000 1 CHOST}. {465314400 32400 0 CHOT}. {481042800 36000 1 CHOST}. {496764000 32400 0 CHOT}. {512492400 36000 1 CHOST}. {528213600 32400 0 CHOT}. {543942000 36000 1 CHOST}. {559663200 32400 0 CHOT}. {575391600 36000 1 CHOST}. {591112800 32400 0 CHOT}. {606841200 36000 1 CHOST}. {622562400 32400 0 CHOT}. {638290800 36000 1 CHOST}. {654616800 32400 0 CHOT}. {670345200 36000 1 CHOST}. {686066400 32400 0 CHOT}. {701794800 36000 1 CHOST}. {717516000 32400 0 CHOT}. {733244400 36000 1 CHOST}. {748965600 32400 0 CHOT}. {764694000 36000 1 CHOST}. {780415200 32400 0 CHOT}. {796143600 36000 1 CHOST}. {811864800 32400 0 CHOT}. {828198000 36000 1 CHOST}. {843919200 32400 0 CHOT}

C:\ProgramData\assignee\tcl\tzdata\Asia\Chongqing

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.2768932458579965
Encrypted:	false
SSDEEP:	12:MBp52DmdHPXARxwDNkq/HxJ2Qzq/hSaq/5Mq/xssjq/Xwq/4N:cQDefAfwkq/Hx4Qzq/hLq/Cq/xrq/Aqe
MD5:	3720CB2DE3247A910A526FBF3B681F37
SHA1:	75C7D2176B2758A819FFE098CD922C79FE27AF74
SHA-256:	66EB4F9AC18F9466458F22E2649D4FBB39110E548BDE4ED06377410BE2C5B250
SHA-512:	5690E09E57ABD94A4AF07D3444ADAD368BD62F9D8FF6C8795F1937F5F8FA5424BE087138E02B7DF26B55C2D34F4A9371132C2A9EFCF28D11E0D7A7E37AFD3283
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Chongqing) {. {-9223372036854775808 25580 0 LMT}. {-1325487980 25200 0 LONT}. {325962000 28800 0 CST}. {515520000 32400 1 CDT}. {527007600 28800 0 CST}. {545155200 32400 1 CDT}. {558457200 28800 0 CST}. {576604800 32400 1 CDT}. {589906800 28800 0 CST}. {608659200 32400 1 CDT}. {621961200 28800 0 CST}. {640108800 32400 1 CDT}. {653410800 28800 0 CST}. {671558400 32400 1 CDT}. {684860400 28800 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Chungking

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.875625624602558
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8S2V4zFVAIgN9Y2/O0L2WFK7LeL9J4WFKh2Vvn:SlSWB9IZaM3yyHzFVAIgUf0L2wK7LUT/
MD5:	FF516E9E575D4C095ED0F9D3E913CB89
SHA1:	BBC40261D702B78513DAA24330EE0158F261922E
SHA-256:	688985C9C836D2011236653F40AAF19E8DED977321BB792E337E6F41E1D87C5A
SHA-512:	93029C2A74B715A14BD3887C4D9E7B2E2D54C5B4EEDAA048F8A0986B69AB27E54F1BE19E6306784F65D9B9DBCB5FE3D2E96B1090E82F6ED5997AF9D3CD686735
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Chongqing)]} {. LoadTimeZoneFile Asia/Chongqing.}.set TZData(:Asia/Chungking) $TZData(:Asia/Chongqing).

C:\ProgramData\assignee\tcl\tzdata\Asia\Colombo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	4.548956625397722
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKr+tJm2OHgPZv9tGZjSWV/FJGTpPUrKBYFD/k5mYdoRVVFJGrR/aYt:MBp52z+mdHgPZvqZj1NJGVPh4/YmYdKQ
MD5:	35533BF2EBC8405BB6E8FEE7D0A36448
SHA1:	BF3278C0ED462F4F75FEC20C9ACBDF144C0D5D6A
SHA-256:	D14D6566F2034769D62EB1341E0816EEF2BC64ACDF62E20F3AA5CA26D66D8E3F
SHA-512:	D6351048DDD441E46F4E7BB3C7559DC0BDC25D93C0C3F76BA99932575D0D7C39C44F032670A89FCA2F1120D4278F702ACE8142E086FAB77C66784DC31CB077F4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Colombo) {. {-9223372036854775808 19164 0 LMT}. {-2840159964 19172 0 MMT}. {-2019705572 19800 0 IST}. {-883287000 21600 1 IHST}. {-862639200 23400 1 IST}. {-764051400 19800 0 IST}. {832962600 23400 0 LKT}. {846266400 21600 0 LKT}. {1145039400 19800 0 IST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Dacca

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.733855608307331
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8ntdVAIgN6Ko2WFK1S2WFKwu:SlSWB9IZaM3yHtdVAIgMKo2wKM2wKwu
MD5:	629FC03B52D24615FB052C84B0F30452
SHA1:	80D24B1A70FC568AB9C555BD1CC70C17571F6061
SHA-256:	BD3E4EE002AFF8F84E74A6D53E08AF5B5F2CAF2B06C9E70B64B05FC8F0B6CA99
SHA-512:	1C912A5F323E84A82D60300F6AC55892F870974D4DEFE0AF0B8F6A87867A176D3F8D66C1A5B11D8560F549D738FFE377DC20EB055182615062D4649BBA011F32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dhaka)]} {. LoadTimeZoneFile Asia/Dhaka.}.set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka).

C:\ProgramData\assignee\tcl\tzdata\Asia\Damascus

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8031
Entropy (8bit):	3.629699951300869
Encrypted:	false
SSDEEP:	96:zY75F5VoNVIkbl3IUQZufk0Eej4YWuM0c5/61a7/VGfV8SbU5J3Mirmgs3LmiK:zI75KN+YlgYE+4YWPB6O4in9
MD5:	202E5950F6324878B0E6FD0056D2F186
SHA1:	A668D4DC3E73A292728CCE136EFFAC95D5952A81
SHA-256:	3BB43B71FF807AA3BF6A7F94680FB8BD586A1471218307A6A7A4CE73A5A3A55E
SHA-512:	5F9A7308E9C08267ECB8D502505EF9B32269D62FA490D6BC01F6927CB8D5B40CA17BB0CDFA3EE78D48C7686EAA7FD266666EB80E54125859F86CADFD7366DB6B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Damascus) {. {-9223372036854775808 8712 0 LMT}. {-1577931912 7200 0 EET}. {-1568592000 10800 1 EEST}. {-1554080400 7200 0 EET}. {-1537142400 10800 1 EEST}. {-1522630800 7200 0 EET}. {-1505692800 10800 1 EEST}. {-1491181200 7200 0 EET}. {-1474243200 10800 1 EEST}. {-1459126800 7200 0 EET}. {-242265600 10800 1 EEST}. {-228877200 7200 0 EET}. {-210556800 10800 1 EEST}. {-197427600 7200 0 EET}. {-178934400 10800 1 EEST}. {-165718800 7200 0 EET}. {-147398400 10800 1 EEST}. {-134269200 7200 0 EET}. {-116467200 10800 1 EEST}. {-102646800 7200 0 EET}. {-84326400 10800 1 EEST}. {-71110800 7200 0 EET}. {-52704000 10800 1 EEST}. {-39488400 7200 0 EET}. {-21168000 10800 1 EEST}. {-7952400 7200 0 EET}. {10368000 10800 1 EEST}. {23583600 7200 0 EET}. {41904000 10800 1 EEST}. {55119600 7200 0 EET}. {73526400 10800 1 EEST}. {86742000 7200 0 EET}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Dhaka

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.487755005841458
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKwfTm2OHEmVFnP9vX+H7MsckVVFJGTL/FG/MEy/ENBErSv/bi/Sv/A:MBp52YfTmdHzdP9P+bXvJGnQt5NBE27C
MD5:	A9B8209EC9E35937C2D41D8D89BE11AC
SHA1:	2612529F907E052EB788E130EE18DCD2FFC6D40E
SHA-256:	5925E4381C7B1317F1FF50CE08BCF7AF2DD2F1FF0F55ECAA73DB36B07BD2CAA9
SHA-512:	09698D8D8CDF3F1FB6D8A83EEBD784C8B411D51F6DBB8779BE701AF743FC5FFB57147FC91B6717E652E37C7DEF5BE94BC3D320759E151BF602519F6C6852A6D9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dhaka) {. {-9223372036854775808 21700 0 LMT}. {-2524543300 21200 0 HMT}. {-891582800 23400 0 BURT}. {-872058600 19800 0 IST}. {-862637400 23400 0 BURT}. {-576138600 21600 0 DACT}. {38772000 21600 0 BDT}. {1230746400 21600 0 BDT}. {1245430800 25200 1 BDST}. {1262278740 21600 0 BDT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Dili

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	4.568808132392647
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKCXeLm2OHnBGeV8/lvyvmnvQ/9KR1avQC:MBp52qXEmdHnBvVYyaL8F
MD5:	102F243B194E0621A74C803928BD2538
SHA1:	8FF3B011F944A078A74EB0F0E20CF93CE8CBBD59
SHA-256:	E0EC22758027F2FCEF23D86ABFCFAB5DF6ED551388AACDD9F5A553A75253E7C7
SHA-512:	39C5C7CD3BDA02D14DDEDC4CD47A9E0F2D73BA67EF42E058B61E2A36E47A4777C65E5FE7EF88F786FFD24B79515BCF7F0BCAE3B6ABA96E5B48E125DE4910BE17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dili) {. {-9223372036854775808 30140 0 LMT}. {-1830414140 28800 0 TLT}. {-879152400 32400 0 JST}. {-766054800 32400 0 TLT}. {199897200 28800 0 CIT}. {969120000 32400 0 TLT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Dubai

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.963122715057284
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKQiXGm2OHvkdvUQK23NVVL:SlSWB9X52wKQZm2OHvsRVNzL
MD5:	2B181DB4C9B360B5B7373DB8A70F47AA
SHA1:	E0A840BF9C5D4C13A29040E5DD7C03D566C8A73E
SHA-256:	061F12109C47BC58000693ACDFA1358CBD88A9D9F6784913C177B623320D793D
SHA-512:	2DC3F62E87A2A52249EABB3164DCE3F295426A0DE514DAAA05309F1676478CAC0A6B2CC14F8578E20E3806AB61A867968050588D8A0C5AAE6900B4203E82D4BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dubai) {. {-9223372036854775808 13272 0 LMT}. {-1577936472 14400 0 GST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Dushanbe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.144027251159681
Encrypted:	false
SSDEEP:	24:cQJeOhnLzFC5+qsnDMg4NjJMtW90cTyTi8GL:5J7qR9xWu/
MD5:	C7218D3EE62FB80760364BB9B702E60D
SHA1:	22E4F10B09074BE08FFA6E1531D06131B2B7BEDB
SHA-256:	7E98FA8D65FC458F1C60916A8ED629D0672901153AFA88CB31D7722906411F9C
SHA-512:	E1B62FAE2B801D82DAEE06339EA02774B9B17518D1C5197C145C101687D7E6058EDDC69BF7750DBBA49B9208FAB74FA5017826ACBEFE133F9D7A3C1245067038
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dushanbe) {. {-9223372036854775808 16512 0 LMT}. {-1441168512 18000 0 DUST}. {-1247547600 21600 0 DUST}. {354909600 25200 1 DUSST}. {370717200 21600 0 DUST}. {386445600 25200 1 DUSST}. {402253200 21600 0 DUST}. {417981600 25200 1 DUSST}. {433789200 21600 0 DUST}. {449604000 25200 1 DUSST}. {465336000 21600 0 DUST}. {481060800 25200 1 DUSST}. {496785600 21600 0 DUST}. {512510400 25200 1 DUSST}. {528235200 21600 0 DUST}. {543960000 25200 1 DUSST}. {559684800 21600 0 DUST}. {575409600 25200 1 DUSST}. {591134400 21600 0 DUST}. {606859200 25200 1 DUSST}. {622584000 21600 0 DUST}. {638308800 25200 1 DUSST}. {654638400 21600 0 DUST}. {670363200 21600 1 DUSST}. {684363600 18000 0 TJT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Gaza

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7963
Entropy (8bit):	3.6574990165665264
Encrypted:	false
SSDEEP:	96:uRGaKoVy0FUeLR2S5nfclzs8x6PxGtv2h4WF1mkWdSejNgMuMDxqE4egHwV6XPQP:uR7Vy0Wet9MPdS+NgMPf4IbS0
MD5:	B86DB8EA7D969D9EC0ED8069849A5C4D
SHA1:	A29DCC78729C0708819113C972D8F9D7376F7DF2
SHA-256:	10F6C569E443583E19A8BB0668F5629F8894FB542615F03C24DFB13EB0C1C74A
SHA-512:	C4B74E82573EB6B5BF119E14D5793F091701576C0E51BD7DAD8B9AD5181C7AB3F51330BC54DA04DD695BAAAAFCE181557F0E956FFECF720B761E94D986383A9F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Gaza) {. {-9223372036854775808 8272 0 LMT}. {-2185409872 7200 0 EET}. {-933645600 10800 1 EET}. {-857358000 7200 0 EET}. {-844300800 10800 1 EET}. {-825822000 7200 0 EET}. {-812685600 10800 1 EET}. {-794199600 7200 0 EET}. {-779853600 10800 1 EET}. {-762656400 7200 0 EET}. {-748310400 10800 1 EET}. {-731127600 7200 0 EET}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000 10800 1 EEST

C:\ProgramData\assignee\tcl\tzdata\Asia\Harbin

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	598
Entropy (8bit):	4.198818418010046
Encrypted:	false
SSDEEP:	12:MBp52TTmdHaXAbpCVctPRLNkq/HxJ2Qzq/hSaq/5Mq/xssjq/Xwq/4N:cQXeIA/hRRkq/Hx4Qzq/hLq/Cq/xrq/C
MD5:	BC6F9801C74820AF97FE8CE940D8DB82
SHA1:	6D746A1DB41B44B4153453752129566BC43B82A6
SHA-256:	14D630B041B239BEC954EF3173B2F5A22FA0D436A3A935A0556BC29B4942580F
SHA-512:	3FB328643C6A8A641220BE2618F96D9E772BC6E93982226DBFD4F4A879B8FC4FB8E33B7F65DDB65B9A659C3E26E15BE4089EC8F84D7D404DD214FBAE956D7FDF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Harbin) {. {-9223372036854775808 30404 0 LMT}. {-1325492804 30600 0 CHAT}. {-1194078600 28800 0 CST}. {-946800000 32400 0 CHAT}. {-115894800 30600 0 CHAT}. {325956600 28800 0 CST}. {515520000 32400 1 CDT}. {527007600 28800 0 CST}. {545155200 32400 1 CDT}. {558457200 28800 0 CST}. {576604800 32400 1 CDT}. {589906800 28800 0 CST}. {608659200 32400 1 CDT}. {621961200 28800 0 CST}. {640108800 32400 1 CDT}. {653410800 28800 0 CST}. {671558400 32400 1 CDT}. {684860400 28800 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Hebron

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7939
Entropy (8bit):	3.6601658382999283
Encrypted:	false
SSDEEP:	96:J2aKoVy0FUeLR2S5nfclzs8x6PxGtv2h4WS1mkWdSejNgMuMDxqE4egHwV6XPQS2:JLVy0Wet9MidS+NgMPf4IbS0
MD5:	C8479B8D5B5A0CD168C05CCD9B4E0898
SHA1:	F1FA6604ECE2C8B47167A2FEC2765EA4EEC18B57
SHA-256:	FE020AA6577A7F15E55932AE800312AAFF47CD4E7A4EDAF9B01B380D5F198FC2
SHA-512:	CAC8FB3355D7A1047047EF9EA552000A67B79111E11A61F1E4BD9026AA93BD73B6BF1FF7E0E983D551F9B002EFB47436EFBA0C960445CFA380225948A5C92551
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hebron) {. {-9223372036854775808 8423 0 LMT}. {-2185410023 7200 0 EET}. {-933645600 10800 1 EET}. {-857358000 7200 0 EET}. {-844300800 10800 1 EET}. {-825822000 7200 0 EET}. {-812685600 10800 1 EET}. {-794199600 7200 0 EET}. {-779853600 10800 1 EET}. {-762656400 7200 0 EET}. {-748310400 10800 1 EET}. {-731127600 7200 0 EET}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000 10800 1 EE

C:\ProgramData\assignee\tcl\tzdata\Asia\Ho_Chi_Minh

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.706647008651454
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKKACm2OHAT1PAACuGLQuGLn:MBp52SmdHqPAASLML
MD5:	75E3F7FB697A6736A5426627246C954F
SHA1:	B5FDFAFEFC989836C2A42AFABF6C016B5E5E0935
SHA-256:	DD009FC431F3A8C290212CFF4E83967FC4ADA0613F3DD3761671C8A7B2FB021F
SHA-512:	EFB49C067891F1F67B92DF742506B46AF7B4E821100113E956161EDE6E2FEFB14B3FEA65FA94A01194BC4858249737C298AD385050D555B7F23EED5AE9A71986
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ho_Chi_Minh) {. {-9223372036854775808 25600 0 LMT}. {-2005974400 25580 0 SMT}. {-1855983920 25200 0 ICT}. {-1819954800 28800 0 ICT}. {-1220428800 25200 0 ICT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Hong_Kong

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	3.923186571913929
Encrypted:	false
SSDEEP:	24:cQPeCtKkjz1lk/mJURqMJDHxyOPq8vWhV0Z8dX83FdX1BzX4JX/v9YsKP2ieGklq:5tK+Zlim0nltdT1BD45X+iA3tnN7
MD5:	BBA59A5886F48DCEC5CEFDB689D36880
SHA1:	8207DE6AB5F7EC6077506ED3AE2EEA3AB35C5FAE
SHA-256:	F66F0F161B55571CC52167427C050327D4DB98AD58C6589FF908603CD53447F0
SHA-512:	D071D97E6773FC22ABCCE3C8BE133E0FDA40C385234FEB23F69C84ABB9042E319D6891BD9CA65F2E0A048E6F374DB91E8880DCD9711A86B79A3A058517A3DBFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hong_Kong) {. {-9223372036854775808 27402 0 LMT}. {-2056693002 28800 0 HKT}. {-907389000 32400 1 HKST}. {-891667800 28800 0 HKT}. {-884246400 32400 0 JST}. {-766746000 28800 0 HKT}. {-747981000 32400 1 HKST}. {-728544600 28800 0 HKT}. {-717049800 32400 1 HKST}. {-694503000 28800 0 HKT}. {-683785800 32400 1 HKST}. {-668064600 28800 0 HKT}. {-654755400 32400 1 HKST}. {-636615000 28800 0 HKT}. {-623305800 32400 1 HKST}. {-605165400 28800 0 HKT}. {-591856200 32400 1 HKST}. {-573715800 28800 0 HKT}. {-559801800 32400 1 HKST}. {-542352600 28800 0 HKT}. {-528352200 32400 1 HKST}. {-510211800 28800 0 HKT}. {-498112200 32400 1 HKST}. {-478762200 28800 0 HKT}. {-466662600 32400 1 HKST}. {-446707800 28800 0 HKT}. {-435213000 32400 1 HKST}. {-415258200 28800 0 HKT}. {-403158600 32400 1 HKST}. {-383808600 28800 0 HKT}. {-371709000 32400 1 HKST}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Hovd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1480
Entropy (8bit):	3.97785812410914
Encrypted:	false
SSDEEP:	24:cQxEecPfwVOxmljIsWSlWaSYBOr5N2KTxy/w3OqxNwBbBWp+vXxQwC:5MfwVMmJIVSlWaSYBOr32KTxy/w37e2j
MD5:	CBD24A67AE9BE4B0E2F1F82F45EC7D7B
SHA1:	5449DFCA8F74451EB430E76AAD9243FA7A5EC149
SHA-256:	4FFE2AE75CC52CD5496BACF364A0F7BF3ACE05C9B2AD00233CC666DB64785E64
SHA-512:	268F26F58CC9E54978BD8771AE05C68D689EC34FB2FD1A6505258A923DDB8E4687524CC3A1FC83728817A7000E5D8A2B59E146C5CAED9FF54AA71406C5D313D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hovd) {. {-9223372036854775808 21996 0 LMT}. {-2032927596 21600 0 HOVT}. {252439200 25200 0 HOVT}. {417978000 28800 1 HOVST}. {433785600 25200 0 HOVT}. {449600400 28800 1 HOVST}. {465321600 25200 0 HOVT}. {481050000 28800 1 HOVST}. {496771200 25200 0 HOVT}. {512499600 28800 1 HOVST}. {528220800 25200 0 HOVT}. {543949200 28800 1 HOVST}. {559670400 25200 0 HOVT}. {575398800 28800 1 HOVST}. {591120000 25200 0 HOVT}. {606848400 28800 1 HOVST}. {622569600 25200 0 HOVT}. {638298000 28800 1 HOVST}. {654624000 25200 0 HOVT}. {670352400 28800 1 HOVST}. {686073600 25200 0 HOVT}. {701802000 28800 1 HOVST}. {717523200 25200 0 HOVT}. {733251600 28800 1 HOVST}. {748972800 25200 0 HOVT}. {764701200 28800 1 HOVST}. {780422400 25200 0 HOVT}. {796150800 28800 1 HOVST}. {811872000 25200 0 HOVT}. {828205200 28800 1 HOVST}. {843926400 25200 0 HOVT}. {

C:\ProgramData\assignee\tcl\tzdata\Asia\Irkutsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.9600198775066993
Encrypted:	false
SSDEEP:	24:cQoew1xTwhTFwDHZwZ3awOvwl2zbufw5+rwg0gRww6wH8/w1Gd+RwYW61/XnEwKI:5y1xx4CP6qaPfDkb1MhdoS
MD5:	4A82846959A64A2D7DC8C6213F2AAF7F
SHA1:	1D39B30B99DF9E6FB57B66843DECF94D97307CF2
SHA-256:	3E4B7962D4B35D2CB84F4A8D34B43551CE63FB988C77882F26A4C0A6850AF9E1
SHA-512:	19A5453800DB50103CC0AF9E84D60694021FB616A004FFC9B3A0E2CFCF1AC5D53390858D57055C81E1972696D83FA973A61075040928D0246EE58D9743131395
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Irkutsk) {. {-9223372036854775808 25040 0 LMT}. {-2840165840 25040 0 IMT}. {-1575874640 25200 0 IRKT}. {-1247554800 28800 0 IRKMMTT}. {354902400 32400 1 IRKST}. {370710000 28800 0 IRKT}. {386438400 32400 1 IRKST}. {402246000 28800 0 IRKT}. {417974400 32400 1 IRKST}. {433782000 28800 0 IRKT}. {449596800 32400 1 IRKST}. {465328800 28800 0 IRKT}. {481053600 32400 1 IRKST}. {496778400 28800 0 IRKT}. {512503200 32400 1 IRKST}. {528228000 28800 0 IRKT}. {543952800 32400 1 IRKST}. {559677600 28800 0 IRKT}. {575402400 32400 1 IRKST}. {591127200 28800 0 IRKT}. {606852000 32400 1 IRKST}. {622576800 28800 0 IRKT}. {638301600 32400 1 IRKST}. {654631200 28800 0 IRKT}. {670356000 25200 0 IRKMMTT}. {670359600 28800 1 IRKST}. {686084400 25200 0 IRKT}. {695761200 28800 0 IRKMMTT}. {701794800 32400 1 IRKST}. {717516000 28800 0 IRKT}. {733255200 32400

C:\ProgramData\assignee\tcl\tzdata\Asia\Istanbul

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.853387718159342
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHt2WFK4HB/8QaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHt2wK4HJ
MD5:	7EC8D7D32DC13BE15122D8E26C55F9A2
SHA1:	5B07C7161F236DF34B0FA83007ECD75B6435F420
SHA-256:	434B8D0E3034656B3E1561615CCA192EFA62942F285CD59338313710900DB6CB
SHA-512:	D8F1999AF509871C0A7184CFEFB0A50C174ABDE218330D9CDC784C7599A655AD55F6F2173096EA91EE5700B978B9A94BBFCA41970206E7ADEB804D0EE03B45ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul).

C:\ProgramData\assignee\tcl\tzdata\Asia\Jakarta

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.5153507787129215
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKcr6m2OHATJesaPfkc5q/wQmWSyvmJdwQo1RoF4mwQmTFSwQL:MBp52E6mdHjF8c5awSSyIwd4F4mwlF1E
MD5:	6AEEF908C9BE8AC7A42146BEEC37FD15
SHA1:	6F7476A32C14FE35B967985D2134A0A0CB428E55
SHA-256:	C4CC999AEC9A37C7CAE4BA5C423D15DF2CDE9F2F69AF1CBE45E54D8AF37DB62A
SHA-512:	410418B28E59CED78B0E81E38134961C65D49EF2731107C434927026D13A58E151F2C5A4BC14F351E694804EA8CE9016C32AB2CFF6FD0E76F5DE91BE561CD1BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jakarta) {. {-9223372036854775808 25632 0 LMT}. {-3231299232 25632 0 JMT}. {-1451719200 26400 0 JAVT}. {-1172906400 27000 0 WIT}. {-876641400 32400 0 JST}. {-766054800 27000 0 WIT}. {-683883000 28800 0 WIT}. {-620812800 27000 0 WIT}. {-189415800 25200 0 WIT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Jayapura

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.832277505445329
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKcjm2OHG4YVkcfvGtowM7CV4zvLn:MBp52omdHNYacf+toBeVkTn
MD5:	13B1790C0CDF28758F75974C305D85A0
SHA1:	35C81E83592391BFB34426ACEB21E4F7C8398CA4
SHA-256:	CF874CF185EA3D24D2DCC830BDEBD9AD619CAA39BF6563A70F8083DB9C16120F
SHA-512:	9FAD0068583194A98D3237522E50C96A4241D2006C2F3E115CE4431471B7796276CCB1F0246F0D430E03A93C2CD14DA2B772E20C6A6D819A3FFF272C540D5434
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jayapura) {. {-9223372036854775808 33768 0 LMT}. {-1172913768 32400 0 EIT}. {-799491600 34200 0 CST}. {-189423000 32400 0 EIT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Jerusalem

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	3.683692524864992
Encrypted:	false
SSDEEP:	96:GzmnxfFtWR8fKnG/QvW+tCE5nfclzs8x6PxGtv2TiGuyLsbAicBnKqXRGlGru6R7:0mK9DivbOKWKwX5BrAZp0
MD5:	005FE6D937588F6A902BF86EDEA160CA
SHA1:	A9863051501D63E8001A376606DD4039BEFF4E9B
SHA-256:	F4C5B81B7660FA18DFF0EE595AEAB8BF59FAA1DA841AF4AC6D21B5A8B7895380
SHA-512:	3D77F7EE91D254BB00F2E8E899F5A301FA64CD6E0F83B70482AD39E67EDEE8A10128D7D223B0266C9BE339ACF4CB37B369F98AF231A5D685384937BC8DF8A8C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jerusalem) {. {-9223372036854775808 8454 0 LMT}. {-2840149254 8440 0 JMT}. {-1641003640 7200 0 IST}. {-933645600 10800 1 IDT}. {-857358000 7200 0 IST}. {-844300800 10800 1 IDT}. {-825822000 7200 0 IST}. {-812685600 10800 1 IDT}. {-794199600 7200 0 IST}. {-779853600 10800 1 IDT}. {-762656400 7200 0 IST}. {-748310400 10800 1 IDT}. {-731127600 7200 0 IST}. {-681962400 14400 1 IDDT}. {-673243200 10800 1 IDT}. {-667962000 7200 0 IST}. {-652327200 10800 1 IDT}. {-636426000 7200 0 IST}. {-622087200 10800 1 IDT}. {-608947200 7200 0 IST}. {-591847200 10800 1 IDT}. {-572486400 7200 0 IST}. {-558576000 10800 1 IDT}. {-542851200 7200 0 IST}. {-527731200 10800 1 IDT}. {-514425600 7200 0 IST}. {-490845600 10800 1 IDT}. {-482986800 7200 0 IST}. {-459475200 10800 1 IDT}. {-451537200 7200 0 IST}. {-428551200 10800 1 IDT}. {-418262400 7200 0 IST}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Kabul

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.853601274352773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKTwkXGm2OHodFxsYvXgVHURRNV3Fqdj/cXHFk5:SlSWB9X52wKTEm2OHoH+YPgVHURbRFIR
MD5:	43B74064BEEB2CE6D805234CB47A1EAB
SHA1:	CE3C389E33948A9C45EFE1CD68D01E7D971014C1
SHA-256:	58A8B20C1CB4C0C2F329A0E7869E1F11223E1AC35AC2C275930543A79689170B
SHA-512:	0618804849BC540480DD6E165CBBCAF7675B74580961D02DAF6A158AD10D47EEA57757115F64A67060C8F3D96917FD21F71733DB16D9C3A5E2F4EB6DD99DC4FA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kabul) {. {-9223372036854775808 16608 0 LMT}. {-2524538208 14400 0 AFT}. {-788932800 16200 0 AFT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Kamchatka

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	3.9243582157859627
Encrypted:	false
SSDEEP:	24:cQ+3e8/95MLQe7+F9b2M7Mx8c8JF5i3L5rSv9Bx12S8+igR7todVMwLF68SRWMnW:5c/ryKF9lcFIvDH2BdIf59e32Ct
MD5:	00EB1A20193C078423934CFD3B84B1CE
SHA1:	1C53A7872A3C9E0398F44DF1F441D81B907B6329
SHA-256:	58E26F3AE41EA89F186F109BC1110121C898995A5DD350EDDE69FB805758C253
SHA-512:	0C70BB8D0BC6A3D1A335CF2EB6F065A1FEBAC2C42FD9F87C29CD84015759F13868C01AF364B5D627FC5B0D749D048CDA51D518FC4A34D82FF45A7B20EB1E7928
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kamchatka) {. {-9223372036854775808 38076 0 LMT}. {-1487759676 39600 0 PETT}. {-1247569200 43200 0 PETMMTT}. {354888000 46800 1 PETST}. {370695600 43200 0 PETT}. {386424000 46800 1 PETST}. {402231600 43200 0 PETT}. {417960000 46800 1 PETST}. {433767600 43200 0 PETT}. {449582400 46800 1 PETST}. {465314400 43200 0 PETT}. {481039200 46800 1 PETST}. {496764000 43200 0 PETT}. {512488800 46800 1 PETST}. {528213600 43200 0 PETT}. {543938400 46800 1 PETST}. {559663200 43200 0 PETT}. {575388000 46800 1 PETST}. {591112800 43200 0 PETT}. {606837600 46800 1 PETST}. {622562400 43200 0 PETT}. {638287200 46800 1 PETST}. {654616800 43200 0 PETT}. {670341600 39600 0 PETMMTT}. {670345200 43200 1 PETST}. {686070000 39600 0 PETT}. {695746800 43200 0 PETMMTT}. {701780400 46800 1 PETST}. {717501600 43200 0 PETT}. {733240800 46800 1 PETST}. {748965600 4320

C:\ProgramData\assignee\tcl\tzdata\Asia\Karachi

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.388322988460791
Encrypted:	false
SSDEEP:	12:MBp52SmdH35S6DvJGnQmYd4vJGNEH+emSvtk6a2iW6oNl:cQSe3pJGnQ1oJGNErmKTh
MD5:	3187FD74C102BA1F43F583EC21C793FE
SHA1:	919FBFE5CA517A691F71FEDFA6708C711C57FB56
SHA-256:	69772D2E11F94B0BF327577C7D323115AF876280B1ACE880885F7A7B8294A98D
SHA-512:	31A68FAE751973F8EC4A5AC635EDB4E6A61FA20EC43EC3E555B93ACCA2BE4138ACAD7B75A2ECEE9FFE57E88561CDC0B19A9B8ACA6477461BCB4A5391B8E46CB2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Karachi) {. {-9223372036854775808 16092 0 LMT}. {-1988166492 19800 0 IST}. {-862637400 23400 1 IST}. {-764145000 19800 0 IST}. {-576135000 18000 0 KART}. {38775600 18000 0 PKT}. {1018119660 21600 1 PKST}. {1033840860 18000 0 PKT}. {1212260400 21600 1 PKST}. {1225476000 18000 0 PKT}. {1239735600 21600 1 PKST}. {1257012000 18000 0 PKT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Kashgar

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	539
Entropy (8bit):	4.260166291497287
Encrypted:	false
SSDEEP:	12:MBp52mrmdH9dXAo/XNkq/HxJ2Qzq/hSaq/5Mq/xssjq/Xwq/4N:cQYeXAo1kq/Hx4Qzq/hLq/Cq/xrq/Aqe
MD5:	A9DD00434A47FA300C70D40A91436662
SHA1:	4A3BE500FC3F4F3F67D918311CA38BF79DC8B62D
SHA-256:	63FF03FC0E0A2767AF2BD071FE6E534C951548D1294FCDD6239FAA80865ED749
SHA-512:	324F94AD202D56EB481E228330FCB8B7AE0C8E5E0528373F96004797386B068B813A309A7856652F1F8E6F8FA7C74CA87DF13E3071B282D7E3443DFE07D1CEE6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kashgar) {. {-9223372036854775808 18236 0 LMT}. {-1325480636 19800 0 KAST}. {-946791000 18000 0 KAST}. {325969200 28800 0 CST}. {515520000 32400 1 CDT}. {527007600 28800 0 CST}. {545155200 32400 1 CDT}. {558457200 28800 0 CST}. {576604800 32400 1 CDT}. {589906800 28800 0 CST}. {608659200 32400 1 CDT}. {621961200 28800 0 CST}. {640108800 32400 1 CDT}. {653410800 28800 0 CST}. {671558400 32400 1 CDT}. {684860400 28800 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Kathmandu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.922860853700539
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKXIi7mFSXGm2OHF+VT5vUQKwMTXvvhGFFRk8P4Vvz7YvC:SlSWB9X52wKYgyJm2OH0T5RNMzvJGzR8
MD5:	22F2D8D0784F512229C97AB2BAA8A74D
SHA1:	094F1A9ED44D2C59AC23FC68BBD79F4A9106CD73
SHA-256:	1FE25575950AFD271395661926068B917FA32360B46B94F8DBF148BFB597D24D
SHA-512:	8AF5BACF0ACD0EA8F25F8FC227BCD2CF18735306F41E11763947B2DFF84229511F712E9E6F893D3CEEB36993503D68969D4B0D0FBFA91F469BDDDC23CF9CBA84
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kathmandu) {. {-9223372036854775808 20476 0 LMT}. {-1577943676 19800 0 IST}. {504901800 20700 0 NPT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Katmandu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.786408960928606
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8yIi7VyVAIgN1AIilHt2WFKSiZ1/2WFKXIi7v:SlSWB9IZaM3y7gVyVAIg5M2wKSg1/2wm
MD5:	A30FEA461B22B2CB3A67A616E3AE08FD
SHA1:	F368B215E15F6F518AEBC92289EE703DCAE849A1
SHA-256:	1E2A1569FE432CDA75C64FA55E24CA6F938C1C72C15FBB280D5B04F6C5E9AD69
SHA-512:	4F3D0681791C23EF19AFF239D2932D2CE1C991406F6DC8E313C083B5E03D806D26337ED2477700596D9A9F4FB1B7FC4A551F897A2A88CB7253CC7F863E586F03
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kathmandu)]} {. LoadTimeZoneFile Asia/Kathmandu.}.set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu).

C:\ProgramData\assignee\tcl\tzdata\Asia\Khandyga

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	3.99768986118624
Encrypted:	false
SSDEEP:	48:5NosZaPG2RxLk3IsfrWEL4mGubhEZIIAs5f:NZa9LLk3IsDWEL4nubqZI7s5f
MD5:	437DF1E640F604BF9850A66EEE161AD0
SHA1:	9DC37AE6263F6E35F79956A70D33CB6A04E11086
SHA-256:	CEBA73E53A4DDAAFED47A40BE153000C71AF35F3212B3DFED703765C29FD5605
SHA-512:	603D017129777A3F36FEB2F6B910602DDE87C321C0B1EBF22E7F0C22F7C18E095FE38BF70822FC459CE9EDC9C2C222F496681771A0BC71BACC0C3BA606787478
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Khandyga) {. {-9223372036854775808 32533 0 LMT}. {-1579424533 28800 0 YAKT}. {-1247558400 32400 0 YAKMMTT}. {354898800 36000 1 YAKST}. {370706400 32400 0 YAKT}. {386434800 36000 1 YAKST}. {402242400 32400 0 YAKT}. {417970800 36000 1 YAKST}. {433778400 32400 0 YAKT}. {449593200 36000 1 YAKST}. {465325200 32400 0 YAKT}. {481050000 36000 1 YAKST}. {496774800 32400 0 YAKT}. {512499600 36000 1 YAKST}. {528224400 32400 0 YAKT}. {543949200 36000 1 YAKST}. {559674000 32400 0 YAKT}. {575398800 36000 1 YAKST}. {591123600 32400 0 YAKT}. {606848400 36000 1 YAKST}. {622573200 32400 0 YAKT}. {638298000 36000 1 YAKST}. {654627600 32400 0 YAKT}. {670352400 28800 0 YAKMMTT}. {670356000 32400 1 YAKST}. {686080800 28800 0 YAKT}. {695757600 32400 0 YAKMMTT}. {701791200 36000 1 YAKST}. {717512400 32400 0 YAKT}. {733251600 36000 1 YAKST}. {748976400 32400

C:\ProgramData\assignee\tcl\tzdata\Asia\Kolkata

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.664826781670047
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKvCm2OHEX3gYPZLvH7MsckVVFJGTL/FG/mYd4VFJL:MBp523CmdHNYPZTbXvJGnQmYd4vJL
MD5:	50F6DB5384D951D8E6D0823FC01F0955
SHA1:	DFC73B73C8C8DFB2D7C14DA8DEA869BF8AF3986B
SHA-256:	FA74FCB73E4E7E510A152D5531779E94DB531D791F09D1A55EE177A4A0BF3320
SHA-512:	F731CA322D84A55EDA9A1CDDA92DFB75FA3D7CE0041EE61F26CDA360F0A3B3B24E752BE7E918C80559F8A0F2B775327CBEDB6702818DCC8814FC0224E6239DD9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kolkata) {. {-9223372036854775808 21208 0 LMT}. {-2840162008 21200 0 HMT}. {-891582800 23400 0 BURT}. {-872058600 19800 0 IST}. {-862637400 23400 1 IST}. {-764145000 19800 0 IST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Krasnoyarsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2066
Entropy (8bit):	3.9524949044733564
Encrypted:	false
SSDEEP:	24:cQOCedXpYVOXgOE2jjyEkFR5Aynx7Xi/X+TipKS5llw+SNXCB3XkE5VXYpobxe5B:5lfKydR/7Sf+uDyPQ3m302jT2o7
MD5:	D140077154EFFBD414A1B73A4EF1E334
SHA1:	BB3AC879198EEB6AE69EF60EAFB80FE95D79D5E4
SHA-256:	05AED196C771EE3CB12356C56F88E41B4ABE85091F33D8A7FD71AF3D7BB3B057
SHA-512:	88AC02D6A717D76A71A59356C3D0B0B974CD3A3BFCCEFC162A6C062517BCD08A0030A80A0ACB064981A24E6FFF5AC096AF1D2211D4057950F990BEF4F1F48CFD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Krasnoyarsk) {. {-9223372036854775808 22280 0 LMT}. {-1577513480 21600 0 KRAT}. {-1247551200 25200 0 KRAMMTT}. {354906000 28800 1 KRAST}. {370713600 25200 0 KRAT}. {386442000 28800 1 KRAST}. {402249600 25200 0 KRAT}. {417978000 28800 1 KRAST}. {433785600 25200 0 KRAT}. {449600400 28800 1 KRAST}. {465332400 25200 0 KRAT}. {481057200 28800 1 KRAST}. {496782000 25200 0 KRAT}. {512506800 28800 1 KRAST}. {528231600 25200 0 KRAT}. {543956400 28800 1 KRAST}. {559681200 25200 0 KRAT}. {575406000 28800 1 KRAST}. {591130800 25200 0 KRAT}. {606855600 28800 1 KRAST}. {622580400 25200 0 KRAT}. {638305200 28800 1 KRAST}. {654634800 25200 0 KRAT}. {670359600 21600 0 KRAMMTT}. {670363200 25200 1 KRAST}. {686088000 21600 0 KRAT}. {695764800 25200 0 KRAMMTT}. {701798400 28800 1 KRAST}. {717519600 25200 0 KRAT}. {733258800 28800 1 KRAST}. {748983600 25

C:\ProgramData\assignee\tcl\tzdata\Asia\Kuala_Lumpur

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	4.564891512259757
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK1NLm2OHrPmdXiWOb/qgOMesF3His0dqgs8kvmQCIqgN3Ln:MBp52PLmdHrPdDTNF+8tLn
MD5:	2A5F7A3B1E59AF73A5E26771A7640E32
SHA1:	386D0762AF8C53811288115B94F284B1A982FEEE
SHA-256:	53136CFAEA9593D2A8A885947C985026DB08F863CCA36FEF510E8C0EFFC3CEF7
SHA-512:	469D5C1278C5D4D2BE6D2DB4F7F9868C13FA33A22E13DBC103DDE53408A1E15B8D0FF6DBFC2E23F55786A57120DE43B911D6DACFAE903FD99F1710650F69B382
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuala_Lumpur) {. {-9223372036854775808 24406 0 LMT}. {-2177477206 24925 0 SMT}. {-2038200925 25200 0 MALT}. {-1167634800 26400 1 MALST}. {-1073028000 26400 0 MALT}. {-894180000 27000 0 MALT}. {-879665400 32400 0 JST}. {-767005200 27000 0 MALT}. {378664200 28800 0 MYT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Kuching

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.287678862773185
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKPLKm2OHXXUTdbNMCmGrMF2Mb9KQzztrDcerbhwBuvbnhMrFeiFd3v:MBp52HLKmdHXXUBOvV9rjhWX7zJZn
MD5:	6F86A0A46810B2AD67806D70EEBBC508
SHA1:	D7B07CD9A4B7C60E2DF2E40128B813BAEB34D40D
SHA-256:	623100A7ECB624F697FFAE978878A080D3A24638D945D179A938AAB04A532DBD
SHA-512:	42C57844B398A58A1AA11DBDE29427BD49F61FC5F3B9E66F7850C94574C8AE692FCAE140AA5E531E65461B95E56B6738DB51495D71E675A84C8F6B93A3D01096
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuching) {. {-9223372036854775808 26480 0 LMT}. {-1383463280 27000 0 BORT}. {-1167636600 28800 0 BORT}. {-1082448000 30000 1 BORTST}. {-1074586800 28800 0 BORT}. {-1050825600 30000 1 BORTST}. {-1042964400 28800 0 BORT}. {-1019289600 30000 1 BORTST}. {-1011428400 28800 0 BORT}. {-987753600 30000 1 BORTST}. {-979892400 28800 0 BORT}. {-956217600 30000 1 BORTST}. {-948356400 28800 0 BORT}. {-924595200 30000 1 BORTST}. {-916734000 28800 0 BORT}. {-893059200 30000 1 BORTST}. {-885198000 28800 0 BORT}. {-879667200 32400 0 JST}. {-767005200 28800 0 BORT}. {378662400 28800 0 MYT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Kuwait

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.948925444416414
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKCEXGm2OHCenvTpBJMdVVvwvYv:SlSWB9X52wKom2OHRLrJcVV
MD5:	C5582D38923249E407BB22C99EAB9995
SHA1:	5F5FDF3CC3E3020A2A8E85732D45F0BE566984D6
SHA-256:	21642AECB98B4715C0C6C21039C8DAC8354FB0543B98E550E054D1CEB0A84588
SHA-512:	6B9327CD8D5AADF46BC2E45A970DD4C3F899E3503307412C581A1F8E940C90FC422D47A5462AC6B23D40FD0CA64C49593ECD8C8B39854A477163FCDD51321282
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuwait) {. {-9223372036854775808 11516 0 LMT}. {-631163516 10800 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Macao

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.729350272507574
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8PpVAIgNz5YF2WFKf+WFKjn:SlSWB9IZaM3yxVAIgLYF2wKGwKjn
MD5:	DB6155900D4556EE7B3089860AD5C4E3
SHA1:	708E4AE427C8BAF589509F4330C389EE55C1D514
SHA-256:	8264648CF1EA3E352E13482DE2ACE70B97FD37FBB1F28F70011561CFCBF533EA
SHA-512:	941D52208FABB634BABCD602CD468F2235199813F4C1C5AB82A453E8C4CE4543C1CE3CBDB9D035DB039CFFDBC94D5D0F9D29363442E2458426BDD52ECDF7C3C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Macau)]} {. LoadTimeZoneFile Asia/Macau.}.set TZData(:Asia/Macao) $TZData(:Asia/Macau).

C:\ProgramData\assignee\tcl\tzdata\Asia\Macau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	3.979357479876244
Encrypted:	false
SSDEEP:	24:cQ2eCXRr4zG7JG/UDzUUas7yAckSTcvZIItNnl2TtCjjz21z2:5oRr4y7o8DSlT+ln91
MD5:	D5EAFB8BDD7331EE6152B1FA3C179492
SHA1:	25AB37395DA05A828CFE545931C9EE0BBC47E4CD
SHA-256:	432CC7EA35F46F1BC95F1863FBC540BD1B541BBFD1CE3FFC2DA404C1104E8596
SHA-512:	F26B1FE6EB3561DBC01671452C72912C18AEE8AD34F49BD2F27E44C253F1A17EA1AE1B7E39EE0908272BF92F974CB84995885EBD271797AA492A33D3B42AABBE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Macau) {. {-9223372036854775808 27260 0 LMT}. {-1830411260 28800 0 MOT}. {-277360200 32400 1 MOST}. {-257405400 28800 0 MOT}. {-245910600 32400 1 MOST}. {-225955800 28800 0 MOT}. {-214473600 32400 1 MOST}. {-194506200 28800 0 MOT}. {-182406600 32400 1 MOST}. {-163056600 28800 0 MOT}. {-150969600 32400 1 MOST}. {-131619600 28800 0 MOT}. {-117088200 32400 1 MOST}. {-101367000 28800 0 MOT}. {-85638600 32400 1 MOST}. {-69312600 28800 0 MOT}. {-53584200 32400 1 MOST}. {-37863000 28800 0 MOT}. {-22134600 32400 1 MOST}. {-6413400 28800 0 MOT}. {9315000 32400 1 MOST}. {25036200 28800 0 MOT}. {40764600 32400 1 MOST}. {56485800 28800 0 MOT}. {72201600 32400 1 MOST}. {87922800 28800 0 MOT}. {103651200 32400 1 MOST}. {119977200 28800 0 MOT}. {135705600 32400 1 MOST}. {151439400 28800 0 MOT}. {167167800 32400 1 MOST}. {182889000 28800 0 MOT}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Magadan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	3.9651960170826297
Encrypted:	false
SSDEEP:	24:cQmech8vhOCTi7ZXltAtwGpd296ymXPO9UHxQdCHt/CXHmW9YbcINu/:5ZvhBiR8ld296yKPO9UHj1UGWgc4u/
MD5:	220CCD03883300BDB065F5C84154C490
SHA1:	D119526A949E7AFD014AF92532BD400E4B69E65A
SHA-256:	C06DFD091FF5F9555C97C40266A9F9164338332EE6E2192C409456EDB3B187D3
SHA-512:	B783445EF178C5497AFD9410038A0883259105B2EAC197C31D735E09426A3DAA1B87068E63C49757B19695BFC6EA489CF2ABE91DD2C6647C7B41D093DE3D2204
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Magadan) {. {-9223372036854775808 36192 0 LMT}. {-1441188192 36000 0 MAGT}. {-1247565600 39600 0 MAGMMTT}. {354891600 43200 1 MAGST}. {370699200 39600 0 MAGT}. {386427600 43200 1 MAGST}. {402235200 39600 0 MAGT}. {417963600 43200 1 MAGST}. {433771200 39600 0 MAGT}. {449586000 43200 1 MAGST}. {465318000 39600 0 MAGT}. {481042800 43200 1 MAGST}. {496767600 39600 0 MAGT}. {512492400 43200 1 MAGST}. {528217200 39600 0 MAGT}. {543942000 43200 1 MAGST}. {559666800 39600 0 MAGT}. {575391600 43200 1 MAGST}. {591116400 39600 0 MAGT}. {606841200 43200 1 MAGST}. {622566000 39600 0 MAGT}. {638290800 43200 1 MAGST}. {654620400 39600 0 MAGT}. {670345200 36000 0 MAGMMTT}. {670348800 39600 1 MAGST}. {686073600 36000 0 MAGT}. {695750400 39600 0 MAGMMTT}. {701784000 43200 1 MAGST}. {717505200 39600 0 MAGT}. {733244400 43200 1 MAGST}. {748969200 39600

C:\ProgramData\assignee\tcl\tzdata\Asia\Makassar

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.702500555605613
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKCm2OHUVRYQTLQTvUfkc3gaTHkH8vmen:MBp526mdHsrTD8cQM7Bn
MD5:	77474CD64DC23E3CBD7B69476BB16D13
SHA1:	993409CCA67B4F6F3116D54C6E251C883C3ECAA4
SHA-256:	5E036E1C4180CEFE48D089C163CCA7B2F65D159CB5D9FC5FB41CABF63495C07D
SHA-512:	EB995DE13E0602C487DC02920379E6D4518BBC188582CEDB91BE8CCDFC4B1127459F5E6FD8BEF5D21AC2636AAE606A9E7F9F3B9AED736FC8D8963398AEE8CD0D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Makassar) {. {-9223372036854775808 28656 0 LMT}. {-1577951856 28656 0 MMT}. {-1172908656 28800 0 CIT}. {-880272000 32400 0 JST}. {-766054800 28800 0 CIT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Manila

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	4.441574068554676
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKefwJm2OHVkezucVAePHZb8vfRvWdAcQzvmy2mRKEjvfgAf5kvfQQC:MBp52G4JmdHnzZBPyHncQzXXjHiH6
MD5:	CCDABEEDF0EC4CC598557F5F7C18568A
SHA1:	D4C3EB158887A7B564DD7462FD8BDD52E95B6B98
SHA-256:	19BA48A251DBCF8435B4D8797AE9EE94CF24D9247A1ADD987B3A6075EB0FE4D3
SHA-512:	A24F2264F258CF502C64FE4EC4ED393D0B74325AB4203D14A97ECEF435D0811196FFA6884328E8B0BCE5348B70665E05549AEB280F880BC901CA6A82E59A938A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Manila) {. {-9223372036854775808 -57360 0 LMT}. {-3944621040 29040 0 LMT}. {-2229321840 28800 0 PHT}. {-1046678400 32400 1 PHST}. {-1038733200 28800 0 PHT}. {-873273600 32400 0 JST}. {-794221200 28800 0 PHT}. {-496224000 32400 1 PHST}. {-489315600 28800 0 PHT}. {259344000 32400 1 PHST}. {275151600 28800 0 PHT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Muscat

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.950706476878056
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKvE+wcXGm2OH6vvUQKX+FVVL:SlSWB9X52wKLwTm2OHCRXzL
MD5:	09E699173EBF983DEBCAF30344DAE627
SHA1:	35B8542EBF15B6B1C11CD22A9AFAC3ED050B89EC
SHA-256:	C6F343564E02CAC8935657EACC3DD14A88D08C9BE44D95DADEF7100EAD828C10
SHA-512:	F5E9F422E2C8DDA95C17C5E51B4B4F5C29CD5409713604BA74F31D34103BE3D99C2760C88034B924A8D11AE44E7EBE2F39D6E04C468977504CC7ABA8CAB5271A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Muscat) {. {-9223372036854775808 14064 0 LMT}. {-1577937264 14400 0 GST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Nicosia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	3.620699686510499
Encrypted:	false
SSDEEP:	96:EPByq7VKviW/naKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:EPFi//uh2kNU4tB715pyzHy1gA
MD5:	21EEEC6314C94D1476C2E79BBACFEB77
SHA1:	2C9805CD01C84D446CBDB90B9542CB24CCDE4E39
SHA-256:	7AAB1AC67D96287EE468608506868707B28FCD27A8F53128621801DCF0122162
SHA-512:	D4B0A0E60B102E10E03CF5BD07C5783E908D5E7079B646177C57C30D67B44C114EFF4DCFC71AF8441D67BD5A351068FBFFD8C5E08F06F1D69946B3EA7D49FC2D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Nicosia) {. {-9223372036854775808 8008 0 LMT}. {-1518920008 7200 0 EET}. {166572000 10800 1 EEST}. {182293200 7200 0 EET}. {200959200 10800 1 EEST}. {213829200 7200 0 EET}. {228866400 10800 1 EEST}. {243982800 7200 0 EET}. {260316000 10800 1 EEST}. {276123600 7200 0 EET}. {291765600 10800 1 EEST}. {307486800 7200 0 EET}. {323820000 10800 1 EEST}. {338936400 7200 0 EET}. {354664800 10800 1 EEST}. {370386000 7200 0 EET}. {386114400 10800 1 EEST}. {401835600 7200 0 EET}. {417564000 10800 1 EEST}. {433285200 7200 0 EET}. {449013600 10800 1 EEST}. {465339600 7200 0 EET}. {481068000 10800 1 EEST}. {496789200 7200 0 EET}. {512517600 10800 1 EEST}. {528238800 7200 0 EET}. {543967200 10800 1 EEST}. {559688400 7200 0 EET}. {575416800 10800 1 EEST}. {591138000 7200 0 EET}. {606866400 10800 1 EEST}. {622587600 7200 0 EET}. {638316000 10800

C:\ProgramData\assignee\tcl\tzdata\Asia\Novokuznetsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.991468050987289
Encrypted:	false
SSDEEP:	24:cQ2fegXpYVOXgOE2jjyEkFR5Aynx7Xi/X+TipKS5llw+SNXCB3XkE5VXYpobxe5l:51fKydR/7Sf+uDyPQ3m302jT2o/
MD5:	5D8B8C58AC2BBAA504B14DCE3587715A
SHA1:	330AB1E3D8D81B5C18A1D7559DB55AECB0276A6A
SHA-256:	416E8BE13EA96AC31DC681747BD25DD10F00906C11BB59E56F9E307451480E90
SHA-512:	4F2D22FD71175F0785C358202DD83549CF92BCE8B76DEF1A2E441F5E324C1CB9DE24A9229614763B2DA0B3E677579E9C05952AC8DB1D07953F24AD6486225035
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novokuznetsk) {. {-9223372036854775808 20928 0 NMT}. {-1577512128 21600 0 KRAT}. {-1247551200 25200 0 KRAMMTT}. {354906000 28800 1 KRAST}. {370713600 25200 0 KRAT}. {386442000 28800 1 KRAST}. {402249600 25200 0 KRAT}. {417978000 28800 1 KRAST}. {433785600 25200 0 KRAT}. {449600400 28800 1 KRAST}. {465332400 25200 0 KRAT}. {481057200 28800 1 KRAST}. {496782000 25200 0 KRAT}. {512506800 28800 1 KRAST}. {528231600 25200 0 KRAT}. {543956400 28800 1 KRAST}. {559681200 25200 0 KRAT}. {575406000 28800 1 KRAST}. {591130800 25200 0 KRAT}. {606855600 28800 1 KRAST}. {622580400 25200 0 KRAT}. {638305200 28800 1 KRAST}. {654634800 25200 0 KRAT}. {670359600 21600 0 KRAMMTT}. {670363200 25200 1 KRAST}. {686088000 21600 0 KRAT}. {695764800 25200 0 KRAMMTT}. {701798400 28800 1 KRAST}. {717519600 25200 0 KRAT}. {733258800 28800 1 KRAST}. {748983600 2

C:\ProgramData\assignee\tcl\tzdata\Asia\Novosibirsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	3.9605964443194677
Encrypted:	false
SSDEEP:	24:cQ2sIe2lNXh/iOIYyxFRP7z/X9TipN5xCB0wuoC1SQ7x7QwC4Jc/srC2TTV9oOux:5HYKKy/RP7zf9uXniu7ZTTwOc
MD5:	B3F21E7096CE4AEE5E5EED20023726FA
SHA1:	14BD32BABBC6CAF0C7362D6F0388850C5B853495
SHA-256:	17BEEA06913102EF3751A2185636D06B87D51CA8387A460B8A33EE1204E7B1C7
SHA-512:	841E8D64AD5104E32786DBE050AEF25E73ECECFF0B54ACE7D3126AA52D9C71C1E953FE67C2732F7E0E2053B8985CB5543B489D274F030BD8D7555E67FB4A166B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novosibirsk) {. {-9223372036854775808 19900 0 LMT}. {-1579476700 21600 0 NOVT}. {-1247551200 25200 0 NOVMMTT}. {354906000 28800 1 NOVST}. {370713600 25200 0 NOVT}. {386442000 28800 1 NOVST}. {402249600 25200 0 NOVT}. {417978000 28800 1 NOVST}. {433785600 25200 0 NOVT}. {449600400 28800 1 NOVST}. {465332400 25200 0 NOVT}. {481057200 28800 1 NOVST}. {496782000 25200 0 NOVT}. {512506800 28800 1 NOVST}. {528231600 25200 0 NOVT}. {543956400 28800 1 NOVST}. {559681200 25200 0 NOVT}. {575406000 28800 1 NOVST}. {591130800 25200 0 NOVT}. {606855600 28800 1 NOVST}. {622580400 25200 0 NOVT}. {638305200 28800 1 NOVST}. {654634800 25200 0 NOVT}. {670359600 21600 0 NOVMMTT}. {670363200 25200 1 NOVST}. {686088000 21600 0 NOVT}. {695764800 25200 0 NOVMMTT}. {701798400 28800 1 NOVST}. {717519600 25200 0 NOVT}. {733258800 28800 1 NOVST}. {738090000 25

C:\ProgramData\assignee\tcl\tzdata\Asia\Omsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	3.877632463933148
Encrypted:	false
SSDEEP:	24:cQaEeTt6l6QFCxZq7LDZgr4jm5+WKvTT5Tm5HTPbEmC5QzCpomuSCh023HlUwCs0:5ampkq9DJ9EHL4mREetpTTyOk
MD5:	59A283ACF2372A6D8AC7080B151FAD3D
SHA1:	853210EF536FED240D7FFA40C8017B6267329966
SHA-256:	FA2FB396488491C7E7E6EC3738C69BA2F1610AE953848D7706ECDE4FFBBEFE80
SHA-512:	38EEC92F34895CCCC985C14E656463FB7E4702F12B74A8C7512AD38BDD31E47A924B6A21C5C3C628C8D470D39112838EDDC3CE98A97319E0DD9CF180A4F77BDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Omsk) {. {-9223372036854775808 17616 0 LMT}. {-1582088016 18000 0 OMST}. {-1247547600 21600 0 OMSMMTT}. {354909600 25200 1 OMSST}. {370717200 21600 0 OMST}. {386445600 25200 1 OMSST}. {402253200 21600 0 OMST}. {417981600 25200 1 OMSST}. {433789200 21600 0 OMST}. {449604000 25200 1 OMSST}. {465336000 21600 0 OMST}. {481060800 25200 1 OMSST}. {496785600 21600 0 OMST}. {512510400 25200 1 OMSST}. {528235200 21600 0 OMST}. {543960000 25200 1 OMSST}. {559684800 21600 0 OMST}. {575409600 25200 1 OMSST}. {591134400 21600 0 OMST}. {606859200 25200 1 OMSST}. {622584000 21600 0 OMST}. {638308800 25200 1 OMSST}. {654638400 21600 0 OMST}. {670363200 18000 0 OMSMMTT}. {670366800 21600 1 OMSST}. {686091600 18000 0 OMST}. {695768400 21600 0 OMSMMTT}. {701802000 25200 1 OMSST}. {717523200 21600 0 OMST}. {733262400 25200 1 OMSST}. {748987200 21600 0 O

C:\ProgramData\assignee\tcl\tzdata\Asia\Oral

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1683
Entropy (8bit):	3.967686330951165
Encrypted:	false
SSDEEP:	24:cQ3eHy9r8hb2JJGI4Sdgb88+8g6zcCbYQftQkSbFQvQQGeQZWbWQhKQDccXQfuQn:5FB8hb2GIpco6Z4b
MD5:	4BAEFD23FCA4E54B97FD87022C99A34C
SHA1:	E43F66AD0D661A280D0E738C5E287DE8E470E7ED
SHA-256:	2D551E0CFCDEB165033A91FB36DB2104C1B1A768EACE2BF722E88555A2981072
SHA-512:	6B34B16EFF99CFE6B12E3A2EF503139CBDBAC162B314DE0D031F5EEF5CC5517DA52965D84367E727924157BF19D2F522031D7760EF4F1B321EBB921C05BA0BCD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Oral) {. {-9223372036854775808 12324 0 LMT}. {-1441164324 14400 0 URAT}. {-1247544000 18000 0 URAT}. {354913200 21600 1 URAST}. {370720800 21600 0 URAT}. {386445600 18000 0 URAT}. {386449200 21600 1 URAST}. {402256800 18000 0 URAT}. {417985200 21600 1 URAST}. {433792800 18000 0 URAT}. {449607600 21600 1 URAST}. {465339600 18000 0 URAT}. {481064400 21600 1 URAST}. {496789200 18000 0 URAT}. {512514000 21600 1 URAST}. {528238800 18000 0 URAT}. {543963600 21600 1 URAST}. {559688400 18000 0 URAT}. {575413200 21600 1 URAST}. {591138000 18000 0 URAT}. {606862800 14400 0 URAT}. {606866400 18000 1 URAST}. {622591200 14400 0 URAT}. {638316000 18000 1 URAST}. {654645600 14400 0 URAT}. {662673600 14400 0 URAT}. {692827200 14400 0 ORAT}. {701809200 18000 1 ORAST}. {717530400 14400 0 ORAT}. {733269600 18000 1 ORAST}. {748994400 14400 0 ORAT}. {

C:\ProgramData\assignee\tcl\tzdata\Asia\Phnom_Penh

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.709832011426896
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKTNMCm2OHAMVPk9ACuGLQuGLn:MBp52lmdHJVPXSLML
MD5:	CE619AC863B4B50623C5D502FF36025C
SHA1:	9EDFCC3FA86C99B5407FBE25CBF1BB5E624FDE7B
SHA-256:	3D1F8D91A90A1DDFC5413BBA540CDCBF07F179A3C2BAD97CD60AEE400AB84E0F
SHA-512:	8D9840E2AC1D774EB00A295A520C2509B7E250EFF185B0A20240868DA15FD85E64F1BF2038ADEE564E8AE553BAD611447DCFF82D99AB21B7CA82F1C4BEAC8CDC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Phnom_Penh) {. {-9223372036854775808 25180 0 LMT}. {-2005973980 25580 0 SMT}. {-1855983920 25200 0 ICT}. {-1819954800 28800 0 ICT}. {-1220428800 25200 0 ICT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Pontianak

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	4.480352314345121
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKT5wFJm2OHUed9xMkc5k/wQmCLkvmJdwQo1RoF4mwQmTFa1HVVivwE:MBp52L5wFJmdHFxbc5kw+LkIwd4F4mwF
MD5:	175472E944709AF50955EE8B40ADA276
SHA1:	BAC49B678E6F7CD63667DBA05303DCBC4D0912CF
SHA-256:	B9D9190291A2135FEC70679697391CAAA08C2E188A14F5BE2331FC5B94416705
SHA-512:	518743317E1459300F0DC0EC391499AE1667BF47B1C416D2140E0C923AD5A747F9476C8FF23BF51F948D7FCEE8EF9508C02DFCB9D3980379410E7C177D5D255C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pontianak) {. {-9223372036854775808 26240 0 LMT}. {-1946186240 26240 0 PMT}. {-1172906240 27000 0 WIT}. {-881220600 32400 0 JST}. {-766054800 27000 0 WIT}. {-683883000 28800 0 WIT}. {-620812800 27000 0 WIT}. {-189415800 28800 0 CIT}. {567964800 25200 0 WIT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Pyongyang

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.595842191693372
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK8cE4Lm2OHnNPU948v+A6/WIkvadA7v7:MBp520cEWmdHnNPU+8mA6/y4A7D
MD5:	5247E3ED25B86955582B1273793D9876
SHA1:	F0A5FCA9BD02C7A0AE33D6CC4A85BB5F2EBDAEBF
SHA-256:	2EC60220F0FE1E837CAAFF448093BBE312EC81DA7CB6E061158406B9666977D0
SHA-512:	A5788CE3F2132A44E6C8CA4BF86C7BA3B5DD04C4E489D3FD9115DDCBB8CEDA3CC4C98CE8215BADF69F6AB43E217DB962681489ACCDE476FF8649EE99C6267459
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pyongyang) {. {-9223372036854775808 30180 0 LMT}. {-2524551780 30600 0 KST}. {-2053931400 32400 0 KST}. {-1325494800 30600 0 KST}. {-1199262600 32400 0 KST}. {-498128400 28800 0 KST}. {-264931200 32400 0 KST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Qatar

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.8601645539109075
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKK3vFSXGm2OHPFV4YvUQKb3VvVVGF5FRVGwvYv:SlSWB9X52wKK3vTm2OHoYRcvzGfFRVS
MD5:	9462D89F06D17A43817EA860AF040C21
SHA1:	EBAFBD932708A7A7228364BDBFCD864AB4BE9022
SHA-256:	6E1A5814923D6C241E19B14BE409EBD3B6E2A21000B55A76F3E8B185C081F847
SHA-512:	2D5617D7113B349F29AF3EBA4B4321CC0A17B1FBF673E7D23FF7482F3F16235E5070281AD73CF5C74DC019DD39F8DD40D1A4D4DDCC08F8C2B6F6D772F4A85501
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qatar) {. {-9223372036854775808 12368 0 LMT}. {-1577935568 14400 0 GST}. {76190400 10800 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Qyzylorda

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	4.021869489592274
Encrypted:	false
SSDEEP:	24:cQweNE9FYaSkXkh8K7hYeO8rmXqI8p/9fIwgdl3xWhf89KukUCN9AC9sdulCddlR:56P0h8UhYqkqI+F7YVYfB8ptOe
MD5:	DF2E642EB0CFE12904C72A4D25663912
SHA1:	69F30DC39AF84B15968CE1EDC14ACCAC3A53C89B
SHA-256:	3B9567139E18C3E7BABA078B8EDB942D1E9E388C7EE44F159D569A713DC7555C
SHA-512:	C31EA6977FF25B8463C8B7D14A1B176C1311E522556A3F8F3C0C54D617CC929927009A870FECF75F52413EDF1E06A12FDFE0A66A9B1974975BB90350ED36C80F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qyzylorda) {. {-9223372036854775808 15712 0 LMT}. {-1441167712 14400 0 KIZT}. {-1247544000 18000 0 KIZT}. {354913200 21600 1 KIZST}. {370720800 21600 0 KIZT}. {386445600 18000 0 KIZT}. {386449200 21600 1 KIZST}. {402256800 18000 0 KIZT}. {417985200 21600 1 KIZST}. {433792800 18000 0 KIZT}. {449607600 21600 1 KIZST}. {465339600 18000 0 KIZT}. {481064400 21600 1 KIZST}. {496789200 18000 0 KIZT}. {512514000 21600 1 KIZST}. {528238800 18000 0 KIZT}. {543963600 21600 1 KIZST}. {559688400 18000 0 KIZT}. {575413200 21600 1 KIZST}. {591138000 18000 0 KIZT}. {606862800 21600 1 KIZST}. {622587600 18000 0 KIZT}. {638312400 21600 1 KIZST}. {654642000 18000 0 KIZT}. {662670000 18000 0 KIZT}. {692823600 18000 0 QYZT}. {695768400 21600 0 QYZT}. {701802000 25200 1 QYZST}. {717523200 21600 0 QYZT}. {733262400 25200 1 QYZST}. {748987200 21600 0 QYZT}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Rangoon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.700824643200826
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK0GEEm2OHGVXdPZNGVyKFMsDVkvm8Y/s59Ln:MBp52nEEmdHGldPZNGYANkhpn
MD5:	21A8C8B771F9644AB3EAED8CA4512408
SHA1:	27D65D7A9E9403103CADA0C0D507708DD98DFC39
SHA-256:	6CFCB7D781F87E1B7ED88FD2DAD6C80DA921CD55B50A1AC650FD2F787201FE2A
SHA-512:	5292EF66277CCE29F10FB55B054A90FB6B4680D387CB4834FF5BF2F182052B5C3F6A8621A1BCEC4671851EFE8B40B8EFC31CC12F5F45DB380F68BD906F26FEB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Rangoon) {. {-9223372036854775808 23080 0 LMT}. {-2840163880 23080 0 RMT}. {-1577946280 23400 0 BURT}. {-873268200 32400 0 JST}. {-778410000 23400 0 MMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Riyadh

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.929505504523299
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFK814tXGm2OHFukevTp+adwvYv:SlSWB9X52wK81Hm2OHF7eLMal
MD5:	C54FE8F9749387B854E378718649629D
SHA1:	5177FE082DFE0BBA954C3FCEF45BC7839C821D6F
SHA-256:	0650B76D22E1126AC00396902D0977AD8C69E8278F0D8E0C0C0866ACE2B14062
SHA-512:	AD85A2038D240E0A9B61FB294592F4F5FF37CDED09AEAAE2CB866B4799A105FC90DAE8D65FD1E3312657A7F36DB534FD4AE5D093B4C2BA324F7F0688B0B6D7BC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Riyadh) {. {-9223372036854775808 11212 0 LMT}. {-631163212 10800 0 AST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Saigon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.899371908380106
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8I65eVyVAIgN2h659Q2WFKwJ6h4WFK365ev:SlSWB9IZaM3yJAVyVAIgA4s2wKl4wKKK
MD5:	A978C9AD6320DA94CB15324CA82C7417
SHA1:	585C232F3FB2693C78C7831C1AF1DC25D6824CA7
SHA-256:	73E1850BB0827043024EAFA1934190413CB36EA6FE18C90EA86B9DBC1D61EEBF
SHA-512:	AE48BFB2A348CA992F2BCD6B1AF7495713B0526C326678309133D3271D90600624C096B4B8678AD7ECD19822E3BB24E27D12680FCA7FAA455D3CE324CE0B88ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ho_Chi_Minh)]} {. LoadTimeZoneFile Asia/Ho_Chi_Minh.}.set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh).

C:\ProgramData\assignee\tcl\tzdata\Asia\Sakhalin

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2123
Entropy (8bit):	3.9225386099969
Encrypted:	false
SSDEEP:	48:5i5mvzfkLCHT2voaWlOvUhxJWHflhQXAYM:gOHT2vRvwAHdSQYM
MD5:	FC3FBB8678F6ADDCC2E8A75C5EA11D11
SHA1:	07031E2083111F1A62FAB06696B085B39E91418F
SHA-256:	BC449A02DA420CB0D2E6FE61FB4C23282EDE71E64761B60D5F0601E5974FB915
SHA-512:	684967E52B175EB77D883FB9D8D168C7EDE5728EF5EED6F9A281407FEAA27512F64FB9F7C6D711EE25029FAC966ABB7B1A167C2F74CEED1020E7CAEDBCF18176
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Sakhalin) {. {-9223372036854775808 34248 0 LMT}. {-2031039048 32400 0 CJT}. {-1009875600 32400 0 JST}. {-768560400 39600 0 SAKMMTT}. {354891600 43200 1 SAKST}. {370699200 39600 0 SAKT}. {386427600 43200 1 SAKST}. {402235200 39600 0 SAKT}. {417963600 43200 1 SAKST}. {433771200 39600 0 SAKT}. {449586000 43200 1 SAKST}. {465318000 39600 0 SAKT}. {481042800 43200 1 SAKST}. {496767600 39600 0 SAKT}. {512492400 43200 1 SAKST}. {528217200 39600 0 SAKT}. {543942000 43200 1 SAKST}. {559666800 39600 0 SAKT}. {575391600 43200 1 SAKST}. {591116400 39600 0 SAKT}. {606841200 43200 1 SAKST}. {622566000 39600 0 SAKT}. {638290800 43200 1 SAKST}. {654620400 39600 0 SAKT}. {670345200 36000 0 SAKMMTT}. {670348800 39600 1 SAKST}. {686073600 36000 0 SAKT}. {695750400 39600 0 SAKMMTT}. {701784000 43200 1 SAKST}. {717505200 39600 0 SAKT}. {733244400 43200 1

C:\ProgramData\assignee\tcl\tzdata\Asia\Samarkand

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.096613862431634
Encrypted:	false
SSDEEP:	12:MBp52tlmdHhV9kSogKk4khWuf7Z/UOfmWnmjDIdhWdMr2jmjdODPRWZsdXT4WuwD:cQtlehHkETh7tmdPIiOdzeJTUPc
MD5:	C734A56858833277CC5C6895EB7CC3FD
SHA1:	8CC1CC9B2B2159CAF7DB4FF4F7B6E3DC3AF4811B
SHA-256:	3937769CEBF476F6E83E2C900D70C729E33CD970B357019AE1E3948215B91CB7
SHA-512:	E60BF531C5DE076033314346B9B0D62BC9009719837A98FE66BB2FE85DD2BE0AE1CD49CCA09784523ABF3DB683AB70E3E78DDDB6FC91A7F320DD6A3AF18D3966
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Samarkand) {. {-9223372036854775808 16032 0 LMT}. {-1441168032 14400 0 SAMT}. {-1247544000 18000 0 SAMT}. {354913200 21600 1 SAMST}. {370720800 21600 0 TAST}. {386445600 18000 0 SAMT}. {386449200 21600 1 SAMST}. {402256800 18000 0 SAMT}. {417985200 21600 1 SAMST}. {433792800 18000 0 SAMT}. {449607600 21600 1 SAMST}. {465339600 18000 0 SAMT}. {481064400 21600 1 SAMST}. {496789200 18000 0 SAMT}. {512514000 21600 1 SAMST}. {528238800 18000 0 SAMT}. {543963600 21600 1 SAMST}. {559688400 18000 0 SAMT}. {575413200 21600 1 SAMST}. {591138000 18000 0 SAMT}. {606862800 21600 1 SAMST}. {622587600 18000 0 SAMT}. {638312400 21600 1 SAMST}. {654642000 18000 0 SAMT}. {670366800 21600 1 SAMST}. {683665200 21600 0 UZST}. {686091600 18000 0 UZT}. {694206000 18000 0 UZT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Seoul

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	488
Entropy (8bit):	4.266401496153091
Encrypted:	false
SSDEEP:	12:MBp525mdHjPH+8mA6/y4wMJSQi3MYVKOXzHBD:cQ5ejHtmA66zMJW3RtjHBD
MD5:	D7FAFCA28785B9D46377BB52681870FF
SHA1:	04318B42954B8F8D206706DB3F206569D35A37D1
SHA-256:	AF653558D09C3BF3DDF08779660A8E393BA7610E7B1812E6B4D679AD6A437FD8
SHA-512:	105A0D8B0F6DF207FEC2E412716C3BA55EE781AA58117CB3A8FD19271A00AF962C1B4E41EEBB2491218A203A1BAF49321C3CA7E27797990A0B5FFAA88B5CE2F4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Seoul) {. {-9223372036854775808 30472 0 LMT}. {-2524552072 30600 0 KST}. {-2053931400 32400 0 KST}. {-1325494800 30600 0 KST}. {-1199262600 32400 0 KST}. {-498128400 28800 0 KST}. {-303984000 32400 1 KDT}. {-293533200 28800 0 KST}. {-264931200 30600 0 KST}. {-39515400 32400 0 KST}. {547570800 36000 1 KDT}. {560872800 32400 0 KST}. {579020400 36000 1 KDT}. {592322400 32400 0 KST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Shanghai

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	626
Entropy (8bit):	4.195217162473369
Encrypted:	false
SSDEEP:	12:MBp52vEmdHrXAwOW5zq/XVucq/GrNkq/HxJ2Qzq/hSaq/5Mq/xssjq/Xwq/4N:cQ8e7AwO+q/Xbq/Ckq/Hx4Qzq/hLq/Cc
MD5:	801AC98AD16AAB728F1037423A8E46C7
SHA1:	5B16F976EFD571C57CB9BE58B896B63A05C32715
SHA-256:	7FA5002B8BAA9A5DA9A842B74AFADC18C118031E74999ABEA1B7B9DAA095C317
SHA-512:	42A3EEB86A88CC38E5DA08E3FF24E4D3767769B0A73043A6AC81792F5C88E631AD7399F5B3CC3DC8E3AADE99EBBB190C982640B6459FC1804C10CCC44EABA823
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Shanghai) {. {-9223372036854775808 29157 0 LMT}. {-1325491557 28800 0 CST}. {-933494400 32400 1 CDT}. {-923130000 28800 0 CST}. {-908784000 32400 1 CDT}. {-891594000 28800 0 CST}. {-662716800 28800 0 CST}. {515520000 32400 1 CDT}. {527007600 28800 0 CST}. {545155200 32400 1 CDT}. {558457200 28800 0 CST}. {576604800 32400 1 CDT}. {589906800 28800 0 CST}. {608659200 32400 1 CDT}. {621961200 28800 0 CST}. {640108800 32400 1 CDT}. {653410800 28800 0 CST}. {671558400 32400 1 CDT}. {684860400 28800 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Singapore

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.499763562586137
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKfbdJm2OHxdPmIWOb/qgOMesF3His0dqgs8kvmQCIqgMQiI/0SGibL:MBp52nbdJmdHDPxDTNF+8tuQ90SrL
MD5:	72F394A6DB71E5E22742EFE4B2A3FE30
SHA1:	2BEAAE84CA2F2725C1A37139C312E56285339561
SHA-256:	B26FC478C496F512E21A6B81CDBFDB437E60F042AE49FFB701647DA2432B5DAA
SHA-512:	27D62AC711656D3D1E6BDDB428C764ECCFF7C6CF5D284096A931EDFE9EF5590D6832F669B0FEB9582FF413E77A0B6385227781A4C2BFC089986A29168FD313FD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Singapore) {. {-9223372036854775808 24925 0 LMT}. {-2177477725 24925 0 SMT}. {-2038200925 25200 0 MALT}. {-1167634800 26400 1 MALST}. {-1073028000 26400 0 MALT}. {-894180000 27000 0 MALT}. {-879665400 32400 0 JST}. {-767005200 27000 0 MALT}. {-138785400 27000 0 SGT}. {378664200 28800 0 SGT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Taipei

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	3.9799801552882723
Encrypted:	false
SSDEEP:	24:cQXbe9ZEq/9cq/9mvTq/KSq/LPq/wO3q/uq/PC9q/hq/Rq/Gq/fq/Aq/Vtyq/fQV:5XwB/d/Mvm/K/W/Ta/1/V/Y/o/d/y/Dg
MD5:	37310BB804FE2EC539C463BECA2B7058
SHA1:	70FE3249B844101FB3ADE6D2649D42193C6831EA
SHA-256:	F3EFBDAC3106359BC02AB30C09D8AAE2FF5E2341A28F493451B68D238757A3AA
SHA-512:	90574B08520F9897CD209DB959606E9ABE0362E5F36A5B86F2134842919B7529A7914C05EDE48FA9934E8C0D970D944724A044A035983C7CAB588889A7750E68
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Taipei) {. {-9223372036854775808 29160 0 LMT}. {-2335248360 28800 0 CST}. {-778579200 32400 1 CDT}. {-765363600 28800 0 CST}. {-747043200 32400 1 CDT}. {-733827600 28800 0 CST}. {-715507200 32400 1 CDT}. {-702291600 28800 0 CST}. {-683884800 32400 1 CDT}. {-670669200 28800 0 CST}. {-652348800 32400 1 CDT}. {-639133200 28800 0 CST}. {-620812800 32400 1 CDT}. {-607597200 28800 0 CST}. {-589276800 32400 1 CDT}. {-576061200 28800 0 CST}. {-562924800 32400 1 CDT}. {-541760400 28800 0 CST}. {-528710400 32400 1 CDT}. {-510224400 28800 0 CST}. {-497174400 32400 1 CDT}. {-478688400 28800 0 CST}. {-465638400 32400 1 CDT}. {-449830800 28800 0 CST}. {-434016000 32400 1 CDT}. {-418208400 28800 0 CST}. {-402480000 32400 1 CDT}. {-386672400 28800 0 CST}. {-370944000 32400 1 CDT}. {-355136400 28800 0 CST}. {-339408000 32400 1 CDT}. {-323600400 28

C:\ProgramData\assignee\tcl\tzdata\Asia\Tashkent

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.052115079834951
Encrypted:	false
SSDEEP:	24:cQZerHqbDfHFCZaqAHDggMBj945uZYQT2TXTxPc:5tPqxNpybVPc
MD5:	F2EE272A80F47B5AEB99CE2563B9CCCB
SHA1:	29D455D504BD5EEFFD265ED1CBE22B55918D62D9
SHA-256:	480AFDD80AAAA98964904130362BDB7CBA8429980290D79E2CBBE433A47A6BCC
SHA-512:	3D55CBC240E0355454A94B3290EB0E7AE533A97928C4E8E745EA67B4D2A5E354231BBBF970A5A46379AFD214F9E08E389AE766CC80654BFA7FE05295E84F7105
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tashkent) {. {-9223372036854775808 16632 0 LMT}. {-1441168632 18000 0 TAST}. {-1247547600 21600 0 TAST}. {354909600 25200 1 TASST}. {370717200 21600 0 TAST}. {386445600 25200 1 TASST}. {402253200 21600 0 TAST}. {417981600 25200 1 TASST}. {433789200 21600 0 TAST}. {449604000 25200 1 TASST}. {465336000 21600 0 TAST}. {481060800 25200 1 TASST}. {496785600 21600 0 TAST}. {512510400 25200 1 TASST}. {528235200 21600 0 TAST}. {543960000 25200 1 TASST}. {559684800 21600 0 TAST}. {575409600 25200 1 TASST}. {591134400 21600 0 TAST}. {606859200 25200 1 TASST}. {622584000 21600 0 TAST}. {638308800 25200 1 TASST}. {654638400 21600 0 TAST}. {670363200 18000 0 TAST}. {670366800 21600 1 TASST}. {683665200 21600 0 UZST}. {686091600 18000 0 UZT}. {694206000 18000 0 UZT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Tbilisi

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	3.9020577686652143
Encrypted:	false
SSDEEP:	24:cQyGemHxNm5aCkbPcXsXZUzJJu8ZmFebPR4c9alNkA/tbd8ttF6E39Uf1IUMc9UJ:5P5Tt5imFTN9VsZ7QZsKen
MD5:	AF05A16CF2B18ABB9CAA489368D00CB4
SHA1:	D761E7C0ED43BD46AA15569BF25BC6DFADFB0965
SHA-256:	5E9A39EFCDEF92BCDD05B9B0DB6A0701DF549D301B5BC3D53123DAE4E12C60CD
SHA-512:	998B94646D2566E30A86B29DE7D95F8AE5376E8118049EAB6837BE6A3126693721D69FA93913C942F5D48EBCF8122530B87C01705E57A25C73D6A091BC0B8CBE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tbilisi) {. {-9223372036854775808 10756 0 LMT}. {-2840151556 10756 0 TBMT}. {-1441162756 10800 0 TBIT}. {-405140400 14400 0 TBIT}. {354916800 18000 1 TBIST}. {370724400 14400 0 TBIT}. {386452800 18000 1 TBIST}. {402260400 14400 0 TBIT}. {417988800 18000 1 TBIST}. {433796400 14400 0 TBIT}. {449611200 18000 1 TBIST}. {465343200 14400 0 TBIT}. {481068000 18000 1 TBIST}. {496792800 14400 0 TBIT}. {512517600 18000 1 TBIST}. {528242400 14400 0 TBIT}. {543967200 18000 1 TBIST}. {559692000 14400 0 TBIT}. {575416800 18000 1 TBIST}. {591141600 14400 0 TBIT}. {606866400 18000 1 TBIST}. {622591200 14400 0 TBIT}. {638316000 18000 1 TBIST}. {654645600 14400 0 TBIT}. {670370400 14400 1 TBIST}. {671140800 14400 0 GEST}. {686098800 10800 0 GET}. {694213200 10800 0 GET}. {701816400 14400 1 GEST}. {717537600 10800 0 GET}. {733266000 14400 1 GEST}. {

C:\ProgramData\assignee\tcl\tzdata\Asia\Tehran

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	3.8446147411925486
Encrypted:	false
SSDEEP:	96:+oDm0LvKjM7z5/PwPHoHsWLYR7BsE8dySscPWQNgqRf9RP2x8O2J024ptlxP/XF5:+oC0LvKjcz5/POHCsWL87BsE8dyjcPWf
MD5:	DAA3AB1A5C0FAF5DED242E1DC4E5E5B7
SHA1:	07EAC7A67E0B7B2B6F69063BB8F82C2392A6E306
SHA-256:	5E138AAE70A3E9E8FBB3B6CC5425984D90D4A1C630CF9A889771E02DC6DFB265
SHA-512:	8902EE1F8A2C9A71B255B61C14D4BDE06E230B8E489560725F4DDE9739F0581FFA0057783944C511A16FC92F905F32242530E983AFD232A6052073ADD40B8753
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tehran) {. {-9223372036854775808 12344 0 LMT}. {-1704165944 12344 0 TMT}. {-757394744 12600 0 IRST}. {247177800 14400 0 IRST}. {259272000 18000 1 IRDT}. {277758000 14400 0 IRST}. {283982400 12600 0 IRST}. {290809800 16200 1 IRDT}. {306531000 12600 0 IRST}. {322432200 16200 1 IRDT}. {338499000 12600 0 IRST}. {673216200 16200 1 IRDT}. {685481400 12600 0 IRST}. {701209800 16200 1 IRDT}. {717103800 12600 0 IRST}. {732745800 16200 1 IRDT}. {748639800 12600 0 IRST}. {764281800 16200 1 IRDT}. {780175800 12600 0 IRST}. {795817800 16200 1 IRDT}. {811711800 12600 0 IRST}. {827353800 16200 1 IRDT}. {843247800 12600 0 IRST}. {858976200 16200 1 IRDT}. {874870200 12600 0 IRST}. {890512200 16200 1 IRDT}. {906406200 12600 0 IRST}. {922048200 16200 1 IRDT}. {937942200 12600 0 IRST}. {953584200 16200 1 IRDT}. {969478200 12600 0 IRST}. {985206600 16

C:\ProgramData\assignee\tcl\tzdata\Asia\Tel_Aviv

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.82789113675599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt2WFK+TT52WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb2wKsswKY7
MD5:	D044282CC9B9F531D8136612B4AA938D
SHA1:	5FD01E48BFFC2B54BBA48926EFD2137A91B57E0F
SHA-256:	FE57D86184A7F4A64F3555DE3F4463531A86BB18F124534F17B09FAB825F83B4
SHA-512:	DBBA54D68F33E51D51E816D79D83B61490BD31262DFF6037C0834BADA48CBC02F4281203D7212EDF6D96F7FF1EF3843299698BF0DFE10B5F1383AA504594505A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem).

C:\ProgramData\assignee\tcl\tzdata\Asia\Thimbu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.858169634371472
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8kNZ4pVAIgNqFNzO62WFK9Z752WFKvNZvn:SlSWB9IZaM3ykZ4pVAIgc3K62wKf12wc
MD5:	B678D97B4E6E6112299746833C06C70B
SHA1:	A49BD45DB59BDD3B7BF9159699272389E8EF77AC
SHA-256:	6AEAE87CAD7FE358A5A1BABE6C0244A3F89403FC64C5AA19E1FFDEDCEB6CF57B
SHA-512:	BEA10EAE5941E027D8FE9E5D5C03FAE5DCFEF7603088E71CA7CCD0461851E175AE1CC7592DFBEC63F91D840E4E0AA04B54549EB71303666E6EA16AFFF6EDA058
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Thimphu)]} {. LoadTimeZoneFile Asia/Thimphu.}.set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu).

C:\ProgramData\assignee\tcl\tzdata\Asia\Thimphu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.8942281798484615
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKvNZLXGm2OHEQUTFnvSVaJKuc/vhGFDV9gmZVFvbv:SlSWB9X52wKVZCm2OHEfnjKuc/JG1V9l
MD5:	F11F6E49B655045210CBC9B97BE8BD32
SHA1:	B4ED9F32D9D18FC247E80AF2D19D2B7AFF58E23F
SHA-256:	FFD5F8C9FF0FE1FF191C35A1910EE39FFD0BC0DCBE045D4651745E9AB175EBD5
SHA-512:	4095C531BF55F7424E01A2A6259F5CECD063CE4DBC5C4830E1AD663BA57B6E7852FDAFD560C599F3E6DB650B0A7E8E3DB8D7985E6CE59DDB30C9B267E21AF2B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Thimphu) {. {-9223372036854775808 21516 0 LMT}. {-706341516 19800 0 IST}. {560025000 21600 0 BTT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Tokyo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.348313926107011
Encrypted:	false
SSDEEP:	12:MBp52XmdHOx5PAfvzRSbL7Kzb674ybFj7azoheja:cQXeOPAfb0vGzu0y5G+eja
MD5:	E157D3653BB1E32EA2C5CE40D8DF3F46
SHA1:	40934505C8852D943D8BB302DFE332331FCAD71C
SHA-256:	AE87FB9907DFE028DE7D472B4DD488BE65511110FCE72CF6665D6EA5AC8772C9
SHA-512:	E3E6ECA25F3154EAECD0F4F9550F90700E9E4CEE0ABB0532574501D69C3564F0461CAAEFC89E1B316272CE0EDB0317CDC50A7E7BE9D38DDDD9028BBDCC2E9E02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tokyo) {. {-9223372036854775808 33539 0 LMT}. {-2587712400 32400 0 JST}. {-2335251600 32400 0 CJT}. {-1009875600 32400 0 JST}. {-683794800 36000 1 JDT}. {-672393600 32400 0 JST}. {-654764400 36000 1 JDT}. {-640944000 32400 0 JST}. {-620290800 36000 1 JDT}. {-609494400 32400 0 JST}. {-588841200 36000 1 JDT}. {-578044800 32400 0 JST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Ujung_Pandang

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.8489855608543575
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8pYFwVAIgNzB0L2WFKPQOrFJ4WFKvn:SlSWB9IZaM3yWFwVAIg8L2wKPQOrFJ4H
MD5:	AF91CF42CFBA12F55AF3E6D26A71946D
SHA1:	673AC77D4E5B6ED7CE8AE67975372462F6AF870B
SHA-256:	D9BCAE393D4B9EE5F308FA0C26A7A6BCE716E77DB056E75A3B39B33A227760C8
SHA-512:	1FD61EA39FF08428486E07AF4404CEA67ACCCB600F11BA74B340A4F663EB8221BC7BF84AE677566F7DDEC0CB42F1946614CD11A9CD7824E0D6CAA804DF0EF514
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Makassar)]} {. LoadTimeZoneFile Asia/Makassar.}.set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar).

C:\ProgramData\assignee\tcl\tzdata\Asia\Ulaanbaatar

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.023186631224087
Encrypted:	false
SSDEEP:	24:cQlTer96UWdKSWdW6zWdQmjWdxtKWdP8zWdIjWdcWdxwWdIWdwxzWddDWd1WdkAJ:569YKVzkQmUF7IUPxjLwOm+kA1sdSkB2
MD5:	DCCA58912445C53230464E3EA373CE15
SHA1:	9105885A954EC79C1C9965EE7BDCF2D35F6F4CAE
SHA-256:	CAFFFC8B561FB0003F12545E878144D5EC74056DC330BB41D1DEACA6C7DA2682
SHA-512:	DA609A7E9FCC25B9342E4F9327973F9D70C5857DDBF8C072D3848E36183E2654A6592452B0F0B39009BD9AD6B3C33DE7EE64C441F93E8A6ACD6AF4B37861FCC7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ulaanbaatar) {. {-9223372036854775808 25652 0 LMT}. {-2032931252 25200 0 ULAT}. {252435600 28800 0 ULAT}. {417974400 32400 1 ULAST}. {433782000 28800 0 ULAT}. {449596800 32400 1 ULAST}. {465318000 28800 0 ULAT}. {481046400 32400 1 ULAST}. {496767600 28800 0 ULAT}. {512496000 32400 1 ULAST}. {528217200 28800 0 ULAT}. {543945600 32400 1 ULAST}. {559666800 28800 0 ULAT}. {575395200 32400 1 ULAST}. {591116400 28800 0 ULAT}. {606844800 32400 1 ULAST}. {622566000 28800 0 ULAT}. {638294400 32400 1 ULAST}. {654620400 28800 0 ULAT}. {670348800 32400 1 ULAST}. {686070000 28800 0 ULAT}. {701798400 32400 1 ULAST}. {717519600 28800 0 ULAT}. {733248000 32400 1 ULAST}. {748969200 28800 0 ULAT}. {764697600 32400 1 ULAST}. {780418800 28800 0 ULAT}. {796147200 32400 1 ULAST}. {811868400 28800 0 ULAT}. {828201600 32400 1 ULAST}. {843922800 28800 0 ULAT

C:\ProgramData\assignee\tcl\tzdata\Asia\Ulan_Bator

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.675919405724711
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8TcXHVAIgNrfcXKxL2WFKhrMEBQWFKucXu:SlSWB9IZaM3yIVAIg7xL2wKhrMEewKI
MD5:	73C6A7BC088A3CD92CAC2F8B019994A0
SHA1:	74D5DCE1100F6C97DFCFAD5EFC310196F03ABED5
SHA-256:	8F075ACF5FF86E5CDE63E178F7FCB692C209B6023C80157A2ABF6826AE63C6C3
SHA-512:	4EAD916D2251CF3A9B336448B467282C251EE5D98299334F365711CCA8CAF9CA83600503A3346AEC9DFA9E9AF064BA6DEF570BABCC48AE5EB954DBF574A769B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ulaanbaatar)]} {. LoadTimeZoneFile Asia/Ulaanbaatar.}.set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar).

C:\ProgramData\assignee\tcl\tzdata\Asia\Urumqi

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	508
Entropy (8bit):	4.264258436616557
Encrypted:	false
SSDEEP:	12:MBp52bCmdH8PXA00Nkq/HxJ2Qzq/hSaq/5Mq/xssjq/Xwq/4N:cQme8APkq/Hx4Qzq/hLq/Cq/xrq/Aq/2
MD5:	116E0F5F275C03961F3AF9E4C33B2AAE
SHA1:	0F4D2592ED55AC752942EE4156721205B1C74CE8
SHA-256:	BBC43C63AC8EE5C7747CBD29A0095197AE0C8F56686F7F7D36213B447D2237F4
SHA-512:	E5192F238324C31C2033CD949A706C6AA9055F43A73BAB29E55AC612411FC361D5AEEEF25EC8509BD764D8F4DFB09C33283CD04D9805F5217A535DFB99E92C60
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Urumqi) {. {-9223372036854775808 21020 0 LMT}. {-1325483420 21600 0 URUT}. {325965600 28800 0 CST}. {515520000 32400 1 CDT}. {527007600 28800 0 CST}. {545155200 32400 1 CDT}. {558457200 28800 0 CST}. {576604800 32400 1 CDT}. {589906800 28800 0 CST}. {608659200 32400 1 CDT}. {621961200 28800 0 CST}. {640108800 32400 1 CDT}. {653410800 28800 0 CST}. {671558400 32400 1 CDT}. {684860400 28800 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Ust-Nera

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	3.9838295563097765
Encrypted:	false
SSDEEP:	24:cQueIlfuvhOCTi7ZXltAtwGpd296ymXPO9UHxQdCHt/CXHmW9YbcINu27:5YWvhBiR8ld296yKPO9UHj1UGWgc4uc
MD5:	83D3FF39432589F70EF6743CB122277E
SHA1:	2C45A061F43CA1189F3285410B3F133C6B3C4B90
SHA-256:	A0D355F49D896C6CD211425B8C68D8E2C2E85752814F939B212EB375B69DDCAE
SHA-512:	F20DFFADD1F70E0BCB05C2296FE2AAD23B508E41714D316F889FE68D7AAAAFE06D255AD12A1F908D5AD7F62AFBCA1CE838124BACB1CCCE4C4E5803031D6905FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ust-Nera) {. {-9223372036854775808 34374 0 LMT}. {-1579426374 28800 0 YAKT}. {354898800 43200 0 MAGST}. {370699200 39600 0 MAGT}. {386427600 43200 1 MAGST}. {402235200 39600 0 MAGT}. {417963600 43200 1 MAGST}. {433771200 39600 0 MAGT}. {449586000 43200 1 MAGST}. {465318000 39600 0 MAGT}. {481042800 43200 1 MAGST}. {496767600 39600 0 MAGT}. {512492400 43200 1 MAGST}. {528217200 39600 0 MAGT}. {543942000 43200 1 MAGST}. {559666800 39600 0 MAGT}. {575391600 43200 1 MAGST}. {591116400 39600 0 MAGT}. {606841200 43200 1 MAGST}. {622566000 39600 0 MAGT}. {638290800 43200 1 MAGST}. {654620400 39600 0 MAGT}. {670345200 36000 0 MAGMMTT}. {670348800 39600 1 MAGST}. {686073600 36000 0 MAGT}. {695750400 39600 0 MAGMMTT}. {701784000 43200 1 MAGST}. {717505200 39600 0 MAGT}. {733244400 43200 1 MAGST}. {748969200 39600 0 MAGT}. {764694000 43200 1 MA

C:\ProgramData\assignee\tcl\tzdata\Asia\Vientiane

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.675818095739543
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKgTjEw/kXGm2OHBbpkevXUWXRzXRldFWCuGCNidF9ndVvC:SlSWB9X52wKgbm2OHQePLSCuGLQuGLn
MD5:	41A12EE51446B0735C94207FF5525939
SHA1:	9FF27C73C07A15D519F9AECBDE9FB131E93F0EDA
SHA-256:	82229C41047E7A82091C399163BFB6332F17A45EEDDF2AC43FF2DD0C069135FA
SHA-512:	7250D3EA7C283E38B169DF48355E6BDF76A6FEB20BCAA65574346089793921A8E5504E25D1603141DAF7331BEDD3DD4E2E071ADBB843321A00383A76D4653E8B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Vientiane) {. {-9223372036854775808 24624 0 LMT}. {-2005973424 25580 0 SMT}. {-1855983920 25200 0 ICT}. {-1819954800 28800 0 ICT}. {-1220428800 25200 0 ICT}.}.

C:\ProgramData\assignee\tcl\tzdata\Asia\Vladivostok

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2069
Entropy (8bit):	3.9484945601417767
Encrypted:	false
SSDEEP:	48:56BB/9YnvKCEzQX8NcD8AxwV47ruR/qRapveJj2iBjGEL4mGubhEZIIAs8:UBdunvTEz1NcD8AxwV47ruR/qRapWJjl
MD5:	640966A3C4CF46D17FE362D9187A32EB
SHA1:	AE613E32D98DC2A628379A6B6B8DCB8053AFEC95
SHA-256:	959DD1235F1BA163C5A9E0D7C9FF4393848BB31A374074BE3A055F5D8FB96B10
SHA-512:	87C05EAB2672C00F98F39C2CE8DDB66455B43F7F06217F43B184EF1C4521F2C6FDF9E32ACF7A75AC2D227695C29935D91F07D9A12D73AD005E670EC913A12016
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Vladivostok) {. {-9223372036854775808 31664 0 LMT}. {-1487321264 32400 0 VLAT}. {-1247562000 36000 0 VLAMMTT}. {354895200 39600 1 VLAST}. {370702800 36000 0 VLAT}. {386431200 39600 1 VLAST}. {402238800 36000 0 VLAT}. {417967200 39600 1 VLAST}. {433774800 36000 0 VLAT}. {449589600 39600 1 VLAST}. {465321600 36000 0 VLAT}. {481046400 39600 1 VLAST}. {496771200 36000 0 VLAT}. {512496000 39600 1 VLAST}. {528220800 36000 0 VLAT}. {543945600 39600 1 VLAST}. {559670400 36000 0 VLAT}. {575395200 39600 1 VLAST}. {591120000 36000 0 VLAT}. {606844800 39600 1 VLAST}. {622569600 36000 0 VLAT}. {638294400 39600 1 VLAST}. {654624000 36000 0 VLAT}. {670348800 32400 0 VLAMMTST}. {670352400 36000 1 VLASST}. {686077200 32400 0 VLAST}. {695754000 36000 0 VLAMMTT}. {701787600 39600 1 VLAST}. {717508800 36000 0 VLAT}. {733248000 39600 1 VLAST}. {748972800

C:\ProgramData\assignee\tcl\tzdata\Asia\Yakutsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	3.9472668883209154
Encrypted:	false
SSDEEP:	24:cQVe25Q6QzVLNoIKtyDYzj7QBLxUDZEAznMkoNiLWk7F0i2zdNIzQu3T0JchwzN7:5+ZaPG2RxLk3Isfr7jrhDbT
MD5:	FD3CC8820706882E6A431144D69BD3F7
SHA1:	C9045321811685439931A70926E20C14D81DD0EC
SHA-256:	88A1705570645EB06CC0A9247679EAC112DE02FD8804BDE6EAEC39230A6E7571
SHA-512:	E96BA60D778F7355CC536296148BA73791DD1171AED828C5A3572F63DC9AB13A11727729FF26C16560D1530A6E68A536CDF1B1897D12BFE8E269B2BBD87A0886
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yakutsk) {. {-9223372036854775808 31120 0 LMT}. {-1579423120 28800 0 YAKT}. {-1247558400 32400 0 YAKMMTT}. {354898800 36000 1 YAKST}. {370706400 32400 0 YAKT}. {386434800 36000 1 YAKST}. {402242400 32400 0 YAKT}. {417970800 36000 1 YAKST}. {433778400 32400 0 YAKT}. {449593200 36000 1 YAKST}. {465325200 32400 0 YAKT}. {481050000 36000 1 YAKST}. {496774800 32400 0 YAKT}. {512499600 36000 1 YAKST}. {528224400 32400 0 YAKT}. {543949200 36000 1 YAKST}. {559674000 32400 0 YAKT}. {575398800 36000 1 YAKST}. {591123600 32400 0 YAKT}. {606848400 36000 1 YAKST}. {622573200 32400 0 YAKT}. {638298000 36000 1 YAKST}. {654627600 32400 0 YAKT}. {670352400 28800 0 YAKMMTT}. {670356000 32400 1 YAKST}. {686080800 28800 0 YAKT}. {695757600 32400 0 YAKMMTT}. {701791200 36000 1 YAKST}. {717512400 32400 0 YAKT}. {733251600 36000 1 YAKST}. {748976400 32400

C:\ProgramData\assignee\tcl\tzdata\Asia\Yekaterinburg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2068
Entropy (8bit):	3.969651550786474
Encrypted:	false
SSDEEP:	24:cQiceiQd0hnwbdYIgOdY3IToxB3CjWODWgYrPmv+ZBUBUucoX:5iQhnwCI1SIQ/g2USJY
MD5:	2480E7AF59077CF8F0F888FB9093BAB8
SHA1:	F7680343EE6CF049FD14B728718181C298210C1C
SHA-256:	44D7E2EDA03D526345CAB53F1CE8D8FD85BBE21182A1D2903F796856A090C2D2
SHA-512:	2AB44808C08F3DB75843167E4580D7ACA0CDA747819BD167BBADB64DD4BC58D9F2F0BB1BAC25966A01146DE84F1219A02E09CA5A59AB05489D9BBDBE61F90859
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yekaterinburg) {. {-9223372036854775808 14544 0 LMT}. {-1592611344 14400 0 SVET}. {-1247544000 18000 0 SVEMMTT}. {354913200 21600 1 SVEST}. {370720800 18000 0 SVET}. {386449200 21600 1 SVEST}. {402256800 18000 0 SVET}. {417985200 21600 1 SVEST}. {433792800 18000 0 SVET}. {449607600 21600 1 SVEST}. {465339600 18000 0 SVET}. {481064400 21600 1 SVEST}. {496789200 18000 0 SVET}. {512514000 21600 1 SVEST}. {528238800 18000 0 SVET}. {543963600 21600 1 SVEST}. {559688400 18000 0 SVET}. {575413200 21600 1 SVEST}. {591138000 18000 0 SVET}. {606862800 21600 1 SVEST}. {622587600 18000 0 SVET}. {638312400 21600 1 SVEST}. {654642000 18000 0 SVET}. {670366800 14400 0 SVEMMTT}. {670370400 18000 1 SVEST}. {686095200 14400 0 SVET}. {695772000 18000 0 YEKMMTT}. {701805600 21600 1 YEKST}. {717526800 18000 0 YEKT}. {733266000 21600 1 YEKST}. {748990800

C:\ProgramData\assignee\tcl\tzdata\Asia\Yerevan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2013
Entropy (8bit):	3.917239737702558
Encrypted:	false
SSDEEP:	48:5x7DSQkgYXcEqmFbkANSJ+HDD64AuqYIeXzqKN08MDRiGUPBsCbBbiELW16sYuJw:7nSQkgycEXFbkANi+HDD6fb1ejqf3DEt
MD5:	85FDC8C4D6E028D88E775DF6958BD692
SHA1:	CF8EE7D6E87483D25F00D3A9586B5506A8960FFE
SHA-256:	9CA1596FC76AE4F64AEEE9350B666F9410EBE91DBFC8C7F2E1BB5EAA425E5EBD
SHA-512:	193BECE3C7B696C98C3D124DFF83C220147FF47A38CBEC5621D37FC673FC471D982E640DD9582ADDC009F5AD04922ABA75863780345EB7F38D8218F166DC5A57
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yerevan) {. {-9223372036854775808 10680 0 LMT}. {-1441162680 10800 0 YERT}. {-405140400 14400 0 YERT}. {354916800 18000 1 YERST}. {370724400 14400 0 YERT}. {386452800 18000 1 YERST}. {402260400 14400 0 YERT}. {417988800 18000 1 YERST}. {433796400 14400 0 YERT}. {449611200 18000 1 YERST}. {465343200 14400 0 YERT}. {481068000 18000 1 YERST}. {496792800 14400 0 YERT}. {512517600 18000 1 YERST}. {528242400 14400 0 YERT}. {543967200 18000 1 YERST}. {559692000 14400 0 YERT}. {575416800 18000 1 YERST}. {591141600 14400 0 YERT}. {606866400 18000 1 YERST}. {622591200 14400 0 YERT}. {638316000 18000 1 YERST}. {654645600 14400 0 YERT}. {670370400 14400 1 YERST}. {685569600 14400 0 AMST}. {686098800 10800 0 AMT}. {701812800 14400 1 AMST}. {717534000 10800 0 AMT}. {733273200 14400 1 AMST}. {748998000 10800 0 AMT}. {764722800 14400 1 AMST}. {78

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Azores

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10092
Entropy (8bit):	3.8655705813821184
Encrypted:	false
SSDEEP:	192:M03qYUil+0n538pCKzZEJV2Ihd58NhbTbW:M06Yfl+0n538pCzhT8NhbTbW
MD5:	E75D3BC64723728316CEB5942B639D00
SHA1:	B41355A21E01451A522F1C46F2089E2C7A7D82D0
SHA-256:	62F5ED90EB0A21486F523FAA9A2ED15DCEF011EDC3150B7A51AD731ED07DF950
SHA-512:	98E2B90B153A15A1590BAF6F5B2555962680C6DA73E1B11ECE0FA3144765CC7280A3CD89AFEAB1FF644DA27BF46E1862F891B5B83AA6955A1C10176B1C5ACBD3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Azores) {. {-9223372036854775808 -6160 0 LMT}. {-2713904240 -6872 0 HMT}. {-1849557928 -7200 0 AZOT}. {-1689548400 -3600 1 AZOST}. {-1677794400 -7200 0 AZOT}. {-1667430000 -3600 1 AZOST}. {-1647730800 -7200 0 AZOT}. {-1635807600 -3600 1 AZOST}. {-1616194800 -7200 0 AZOT}. {-1604358000 -3600 1 AZOST}. {-1584658800 -7200 0 AZOT}. {-1572735600 -3600 1 AZOST}. {-1553036400 -7200 0 AZOT}. {-1541199600 -3600 1 AZOST}. {-1521500400 -7200 0 AZOT}. {-1442444400 -3600 1 AZOST}. {-1426806000 -7200 0 AZOT}. {-1379286000 -3600 1 AZOST}. {-1364770800 -7200 0 AZOT}. {-1348441200 -3600 1 AZOST}. {-1333321200 -7200 0 AZOT}. {-1316386800 -3600 1 AZOST}. {-1301266800 -7200 0 AZOT}. {-1284332400 -3600 1 AZOST}. {-1269817200 -7200 0 AZOT}. {-1221433200 -3600 1 AZOST}. {-1206918000 -7200 0 AZOT}. {-1191193200 -3600 1 AZOST}. {-1175468400 -7200 0 AZOT}. {

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Bermuda

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7684
Entropy (8bit):	3.7376923223964162
Encrypted:	false
SSDEEP:	192:UdPvxrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4E:lJv
MD5:	E55A91A96E1DC267AAEFAF27866F0A90
SHA1:	A3E8DB332114397F4F487256E9168E73784D3637
SHA-256:	A2EB47B25B3A389907DD242C86288073B0694B030B244CCF90421C0B510267BD
SHA-512:	9A8140365D76F1A83A98A35593638F2C047B3D2B1E9D0F6ACB2B321EBDB9CC5B6C8CCD3C110B127A12DCDB7D9ED16A8F7DB7DA7A8B4587486D060FACCA23F993
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Bermuda) {. {-9223372036854775808 -15558 0 LMT}. {-1262281242 -14400 0 AST}. {136360800 -10800 0 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {189316800 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Canary

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6638
Entropy (8bit):	3.7197584018658656
Encrypted:	false
SSDEEP:	96:KXysG30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:KXHIMj544IrvfMsbxZTH7qwQ
MD5:	AAE85975BA7E3409A6E0A224E4D851B7
SHA1:	CCF04296A11134D9E8F043C6147A210E13BEDAD4
SHA-256:	EFAAB28570806862B2C14185FD6AB103264FF8C3795DD6BD8EDABB435B532218
SHA-512:	2E836DF6FC2F6F4634386706C3EA5E2D5769A8FDC58A030AFB39ECD22BBB8259F1C89BC037CE6AF1074341A2D944DC5941DDD0F768F1A8283BC6B1831DC9216F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Canary) {. {-9223372036854775808 -3696 0 LMT}. {-1509663504 -3600 0 CANT}. {-733874400 0 0 WET}. {323827200 3600 1 WEST}. {338947200 3600 0 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Cape_Verde

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.738409097680679
Encrypted:	false
SSDEEP:	6:SlSWB9X52RQ7Sm2OHDd0dtv+kdRfykVv+kZ+n7C:MBp5267SmdHD+CkffyXkQ7C
MD5:	AD3414825F9CF7235A14E2C5137D78EF
SHA1:	62E9A2B3618A74907376ACA8376CBCB6CBEA7BE8
SHA-256:	10A26A6B0F4FA276732D931A636446F62CDE425C2034C97697ACF2E76BDB68A6
SHA-512:	C42E19ACD89C1CC6C5D8C285A2F219DFB61C5EE26D1D69DCAA8DBA3A9C85ED70BAF174CEA4826DD9C82BFFEA78D918B45B5D8DD4877EE1B6D49025CFDAE0C919
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Cape_Verde) {. {-9223372036854775808 -5644 0 LMT}. {-1988144756 -7200 0 CVT}. {-862610400 -3600 1 CVST}. {-764118000 -7200 0 CVT}. {186120000 -3600 0 CVT}.}.

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Faeroe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.655846706649014
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqLG4E2wFVAIgvMG4EeL2RQqG4EZrB/4RQqG4Ei:SlSWB9IZaM3yCwFVAIgvgL2RQ1rB/4R/
MD5:	08C5EE09B8BE16C5E974BA8070D448EA
SHA1:	D171C194F6D61A891D3390FF6492AEFB0F67646A
SHA-256:	7C6A6BCF5AAEAB1BB57482DF1BBC934D367390782F6D8C5783DBBBE663169A9B
SHA-512:	E885F3C30DBE178F88464ED505BA1B838848E6BB15C0D27733932CD0634174D9645C5098686E183CC93CB46DE7EB0DBF2EB64CB77A50FC337E2581E25107C9A6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Faroe)]} {. LoadTimeZoneFile Atlantic/Faroe.}.set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe).

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Faroe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6551
Entropy (8bit):	3.7148806034051316
Encrypted:	false
SSDEEP:	96:9bd30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:8IMj544IrvfMsbxZTH7qwQ
MD5:	918E1825106C5C73B203B718918311DC
SHA1:	7C31B3521B396FE6BE7162BAECC4CFB4740F622B
SHA-256:	B648E691D8F3417B77EFB6D6C2F5052B3C4EAF8B5354E018EE2E9BD26F867B71
SHA-512:	5B1B5FE82A13127E3C63C8FB0A8CBD45A7277EF29720B937BB3174E8301830018755416D604F3551622E2E4D365D35E4EE1DF39B587A73E43AE0C68D1996B771
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Faroe) {. {-9223372036854775808 -1624 0 LMT}. {-1955748776 0 0 WET}. {347155200 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WET}. {828234000 3600 1 WEST}. {846378000 0 0 WET}.

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Jan_Mayen

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.92967249261586
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2RQqG0EHEcAg/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2RQaK8H
MD5:	AD9B5217497DBC1CE598573B85F3C056
SHA1:	60984544F5BBD4A5B2B8F43741D66A573A2CF1DC
SHA-256:	BE291E952254B6F0C95C2E2497BE12410D7F1E36D0D1035B3A9BC65D0EDCB65F
SHA-512:	F5D47008495425C386EBAB426195393168E402726405CF23826571E548A3CEFABBA51D87D637C0724FF2CC4F1276D81EACF14D0F9CFC7CBFCC025EEFA0960278
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo).

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Madeira

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9568
Entropy (8bit):	3.848849485880252
Encrypted:	false
SSDEEP:	192:jZagJmz1qVIZtQIMj544IrvfMsbxZTH7qwQ:jZagJmz1qVIZtbMUM8xZTH7qwQ
MD5:	29DFDDBC3F9D28FC86562E7248853258
SHA1:	B2E6FED5CE4ADD1F3653268D8CC734DBCFEEF8C6
SHA-256:	34F5B676D078AF3987C03D0854F5B2888E50657193710C6C2C69A36ADC9B49FB
SHA-512:	B75798BF1C3AB11A5DD0DA7F9F1C9901160B9ACE6A50C2AD40FD1AB77C208027D3286E3BFE7BF389B193D10278FCDEF4C1C68739D935CD2F50440260DB3DAC4F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Madeira) {. {-9223372036854775808 -4056 0 LMT}. {-2713906344 -4056 0 FMT}. {-1849560744 -3600 0 MADT}. {-1689552000 0 1 MADST}. {-1677798000 -3600 0 MADT}. {-1667433600 0 1 MADST}. {-1647734400 -3600 0 MADT}. {-1635811200 0 1 MADST}. {-1616198400 -3600 0 MADT}. {-1604361600 0 1 MADST}. {-1584662400 -3600 0 MADT}. {-1572739200 0 1 MADST}. {-1553040000 -3600 0 MADT}. {-1541203200 0 1 MADST}. {-1521504000 -3600 0 MADT}. {-1442448000 0 1 MADST}. {-1426809600 -3600 0 MADT}. {-1379289600 0 1 MADST}. {-1364774400 -3600 0 MADT}. {-1348444800 0 1 MADST}. {-1333324800 -3600 0 MADT}. {-1316390400 0 1 MADST}. {-1301270400 -3600 0 MADT}. {-1284336000 0 1 MADST}. {-1269820800 -3600 0 MADT}. {-1221436800 0 1 MADST}. {-1206921600 -3600 0 MADT}. {-1191196800 0 1 MADST}. {-1175472000 -3600 0 MADT}. {-1127692800 0 1 MADST}. {-1111968000 -3600 0 MAD

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Reykjavik

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	3.933260527747483
Encrypted:	false
SSDEEP:	48:50hGWG3eGiGAGlGdG38GCGu9GoGllG7yGPGYvGHGqGCGEFGrOG6BGFGjGgGSaGZK:Tl39RXkM3TxBvi7h+YemJx1htEy3S5ZK
MD5:	813097037A96412A060BC45D271FB924
SHA1:	F8F22CAA41B28532AB63F94197F2B6729DBA7084
SHA-256:	9175FD0F69436B341D05FF7220F01523A4AA532A72C8E0E90461AED662D1C56B
SHA-512:	2281AC248AD70FCB67E41790B601BA27596FC1E392C71C7C676E4CEC05D829E1967FC313333A258FF1DA7A08C90BEE70DC21B30A0C22A300BCDD02C35448C8C0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Reykjavik) {. {-9223372036854775808 -5244 0 LMT}. {-4197047556 -5268 0 RMT}. {-1956609132 -3600 0 IST}. {-1668211200 0 1 ISST}. {-1647212400 -3600 0 IST}. {-1636675200 0 1 ISST}. {-1613430000 -3600 0 IST}. {-968025600 0 1 ISST}. {-949615200 -3600 0 IST}. {-942008400 0 1 ISST}. {-920239200 -3600 0 IST}. {-909957600 0 1 ISST}. {-888789600 -3600 0 IST}. {-877903200 0 1 ISST}. {-857944800 -3600 0 IST}. {-846453600 0 1 ISST}. {-826495200 -3600 0 IST}. {-815004000 0 1 ISST}. {-795045600 -3600 0 IST}. {-783554400 0 1 ISST}. {-762991200 -3600 0 IST}. {-752104800 0 1 ISST}. {-731541600 -3600 0 IST}. {-717631200 0 1 ISST}. {-700092000 -3600 0 IST}. {-686181600 0 1 ISST}. {-668642400 -3600 0 IST}. {-654732000 0 1 ISST}. {-636588000 -3600 0 IST}. {-623282400 0 1 ISST}. {-605743200 -3600 0 IST}. {-591832800 0 1 ISST}. {-573688800 -3600

C:\ProgramData\assignee\tcl\tzdata\Atlantic\South_Georgia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.004788019784553
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52RQqGtlN62/EUXGm2OHXT14YvXhFvd6WL:SlSWB9X52RQrlo2Mbm2OHXqYPTF6WL
MD5:	954625C02619664D3B5C4B72A22D8C51
SHA1:	933A7E9368864232B29823FEEFE045032BE154A5
SHA-256:	D23882718ECEB397D330B463DCA1C7E266134F060E0AED421F056E7379E3E1A3
SHA-512:	DD9E58A17967F91937BB71C6A9DD296B4AE49DD7C264874E6720D2B521EAFC1D4F3BF0CA66F931BA16499225390DD963110E9FE8524130F407328E3E9F8BD8BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/South_Georgia) {. {-9223372036854775808 -8768 0 LMT}. {-2524512832 -7200 0 GST}.}.

C:\ProgramData\assignee\tcl\tzdata\Atlantic\St_Helena

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.919232775001251
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52RQqGt4EcXGm2OHeH+YvXBNUWjcrciU1WXVLd:SlSWB9X52RQr4wm2OHhYPBBQIiU1WXv
MD5:	44CE7C3343864A2881C9B97863DDAB40
SHA1:	E74D134D8DD76FDA0FC9054F7FA2B5EF92E06E6F
SHA-256:	632D25BBEF9EAE2A82D3288DCD66C8874A1B11CC9A045C1C8DA0883B454B2375
SHA-512:	39CB2DF3993306C551F8188E01436425978831D4FDAAE5EEA6AE5943D6131B190429384ABD1D5A6749805138CC486467BB03D04E1003239B342DEDC023673879
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/St_Helena) {. {-9223372036854775808 -1368 0 LMT}. {-2524520232 -1368 0 JMT}. {-599614632 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Atlantic\Stanley

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2215
Entropy (8bit):	3.889108793636345
Encrypted:	false
SSDEEP:	48:50wqSiSiSafSYSGpSWW75ESrS0SFSpSL/ShSvSCSCZSCSwSKUXSzSNSnSw/S/pSu:Pq5vz9Ny7OSpgEk/kyXZLhWX2IeXApZ5
MD5:	B08E4FE18C411591DB170A4C995088CA
SHA1:	6D3928877CEF2C20924BA30FBF61EA6933EF925C
SHA-256:	E1410499E96950029924485AB21250C09AB0E3494DD05128C935FB99C8BBABE9
SHA-512:	888CBB8C19F677B73D6203B622501922BD4DC59FA6D962A4EEE6C6DA2A0047739346E0794C5F6D0482BDDAB89289479D2A07986C3C23739657B02FF3B4000AB9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Stanley) {. {-9223372036854775808 -13884 0 LMT}. {-2524507716 -13884 0 SMT}. {-1824235716 -14400 0 FKT}. {-1018209600 -10800 1 FKST}. {-1003093200 -14400 0 FKT}. {-986760000 -10800 1 FKST}. {-971643600 -14400 0 FKT}. {-954705600 -10800 1 FKST}. {-939589200 -14400 0 FKT}. {-923256000 -10800 1 FKST}. {-908139600 -14400 0 FKT}. {-891806400 -10800 1 FKST}. {-876690000 -14400 0 FKT}. {-860356800 -10800 1 FKST}. {420606000 -7200 0 FKT}. {433303200 -7200 1 FKST}. {452052000 -10800 0 FKT}. {464151600 -7200 1 FKST}. {483501600 -10800 0 FKT}. {495597600 -14400 0 FKT}. {495604800 -10800 1 FKST}. {514350000 -14400 0 FKT}. {527054400 -10800 1 FKST}. {545799600 -14400 0 FKT}. {558504000 -10800 1 FKST}. {577249200 -14400 0 FKT}. {589953600 -10800 1 FKST}. {608698800 -14400 0 FKT}. {621403200 -10800 1 FKST}. {640753200 -14400 0 FKT}. {652852800

C:\ProgramData\assignee\tcl\tzdata\Australia\ACT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.813373101386862
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjpMFBx/h4QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCeMFB/4D2
MD5:	F48AD4B81CD3034F6E5D3CA1B5A8BDD4
SHA1:	676FE3F50E3E132C1FD185A1EE1D8C830763204F
SHA-256:	553D7DA9A2EDBD933E8920573AE6BCBAA00302817939046CF257CAEACEC19FAD
SHA-512:	36A4E2286FBEF2F4ED4B9CD1A71136E227FEF4B693F9F43649B790E859221EE470679A7E3C283770DA5CB0113A1C8C1F99480E7020328FFE3E9C870798B092F5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/ACT) $TZData(:Australia/Sydney).

C:\ProgramData\assignee\tcl\tzdata\Australia\Adelaide

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7831
Entropy (8bit):	3.695348510541158
Encrypted:	false
SSDEEP:	96:JMWq8at75CXhCV6hGyM6uXaVQDOmbMxJoOEA+AneZFJP0jWEvAj6hA2nP5Mk9K15:JM2aScwcXaVUbMzoOEAi4QP+KTyK
MD5:	1033576141DC981DC146C0E0A559F84F
SHA1:	0A5AFCA223A15C606816C112B00653CCA06F1B49
SHA-256:	63A457205CF469C00EA5C18932E690C3003239C125A56906EDAD7FBA0C8AD3D4
SHA-512:	762C409B5339C74C7F27B269AF8ABFF0672A2AA85732E212317F6E675B4485C0EBA23261C0DC94574689F44E63ADE21B618DBEB13938ACEE219CBA6E564BF7EB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Adelaide) {. {-9223372036854775808 33260 0 LMT}. {-2364110060 32400 0 CST}. {-2230189200 34200 0 CST}. {-1672565340 37800 1 CST}. {-1665390600 34200 0 CST}. {-883639800 37800 1 CST}. {-876126600 34200 0 CST}. {-860398200 37800 1 CST}. {-844677000 34200 0 CST}. {-828343800 37800 1 CST}. {-813227400 34200 0 CST}. {31501800 34200 0 CST}. {57688200 37800 1 CST}. {67969800 34200 0 CST}. {89137800 37800 1 CST}. {100024200 34200 0 CST}. {120587400 37800 1 CST}. {131473800 34200 0 CST}. {152037000 37800 1 CST}. {162923400 34200 0 CST}. {183486600 37800 1 CST}. {194977800 34200 0 CST}. {215541000 37800 1 CST}. {226427400 34200 0 CST}. {246990600 37800 1 CST}. {257877000 34200 0 CST}. {278440200 37800 1 CST}. {289326600 34200 0 CST}. {309889800 37800 1 CST}. {320776200 34200 0 CST}. {341339400 37800 1 CST}. {352225800 34200 0 CST}.

C:\ProgramData\assignee\tcl\tzdata\Australia\Brisbane

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	633
Entropy (8bit):	4.187124529877168
Encrypted:	false
SSDEEP:	6:SlSWB9X52DC7Wvm2OHL/mYPqCIcrWE9/593ZSeE9VerhaYY984B8UpN5in:MBp52nmdHLOYPhCkIr5mZ
MD5:	5091BF610EE393896C7DCD4A579F6984
SHA1:	8ED51F0377A77B27F37E62CEDB191EE233240503
SHA-256:	6519F2F3FD64BE78A208B05A4EE38DD065ACF0A3DD73F67906986AA94FE6A5F7
SHA-512:	97FA18CFEADF63B9E86E16EE3E1089A9DA715BFE15C1C03372583C3A54DBE5EF62FADBDDA89E5E4D7A947D43E8C73C7B3F975188A18ECBB411EEF8AAA8A2DEB7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Brisbane) {. {-9223372036854775808 36728 0 LMT}. {-2366791928 36000 0 EST}. {-1672567140 39600 1 EST}. {-1665392400 36000 0 EST}. {-883641600 39600 1 EST}. {-876128400 36000 0 EST}. {-860400000 39600 1 EST}. {-844678800 36000 0 EST}. {-828345600 39600 1 EST}. {-813229200 36000 0 EST}. {31500000 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {625593600 39600 1 EST}. {636480000 36000 0 EST}. {657043200 39600 1 EST}. {667929600 36000 0 EST}. {688492800 39600 1 EST}. {699379200 36000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\Australia\Broken_Hill

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7892
Entropy (8bit):	3.702480794401623
Encrypted:	false
SSDEEP:	96:ERiWq8at75chCVJLAyg6uXaVQDOmbMxJoOEA+AneZFJP0jWEvAj6hA2nP5Mk9K15:ERi2a7BIXaVUbMzoOEAi4QP+KTyK
MD5:	CA4219C56719169129AC6986DCFE8817
SHA1:	4C03E4C3A9CA95421A4F713F839900526A7D5CBE
SHA-256:	0DC0EFB9C0D598F6AA7C92B9B980FA3F4C31303770CCF19BA4097E6A94B3610C
SHA-512:	7B004317F5FA3A28BDB166EB7AC16E4203F88FC75B90CA3C686CD13C1FCE3233382849F594378DD4C69534783AC631CE76CB009F654A444C0B0835ADE354E044
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Broken_Hill) {. {-9223372036854775808 33948 0 LMT}. {-2364110748 36000 0 EST}. {-2314951200 32400 0 CST}. {-2230189200 34200 0 CST}. {-1672565340 37800 1 CST}. {-1665390600 34200 0 CST}. {-883639800 37800 1 CST}. {-876126600 34200 0 CST}. {-860398200 37800 1 CST}. {-844677000 34200 0 CST}. {-828343800 37800 1 CST}. {-813227400 34200 0 CST}. {31501800 34200 0 CST}. {57688200 37800 1 CST}. {67969800 34200 0 CST}. {89137800 37800 1 CST}. {100024200 34200 0 CST}. {120587400 37800 1 CST}. {131473800 34200 0 CST}. {152037000 37800 1 CST}. {162923400 34200 0 CST}. {183486600 37800 1 CST}. {194977800 34200 0 CST}. {215541000 37800 1 CST}. {226427400 34200 0 CST}. {246990600 37800 1 CST}. {257877000 34200 0 CST}. {278440200 37800 1 CST}. {289326600 34200 0 CST}. {309889800 37800 1 CST}. {320776200 34200 0 CST}. {341339400 37800 1 CST}

C:\ProgramData\assignee\tcl\tzdata\Australia\Canberra

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.80238049701662
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjnSV1+QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCcq+DCyu
MD5:	16F9CFC4C5B9D5F9F9DB9346CECE4393
SHA1:	ED1ED7BA73EB287D2C8807C4F8EF3EFA516F5A68
SHA-256:	853A159B8503B9E8F42BBCE60496722D0A334FD79F30448BAD651F18BA388055
SHA-512:	9572CCB1BC499BADA72B5FE533B56156DB9EB0DEDFD4AE4397AD60F2A8AF5991F7B1B06A1B8D14C73832543AF8C12F5B16A9A80D093BF0C7ED6E38FF8B66E197
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/Canberra) $TZData(:Australia/Sydney).

C:\ProgramData\assignee\tcl\tzdata\Australia\Currie

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	3.6469974318008025
Encrypted:	false
SSDEEP:	96:GkiB8UWKgXyDodb9WNSpK3vfK8z/pCdnoyCD72xeflcIQiq8DHYa:Gkcarb9WNSpKfCiksT
MD5:	96DEAD7ADC8EB64376A1604ECA5BD8AE
SHA1:	C15F61DD880FE1AC220ED3C2B036EC602B291ADA
SHA-256:	8F3AF27F88D5A5B9F21379AE8E80C5D9D4FC99C7442D9E2270E793D37E03ECEE
SHA-512:	8A0C9738B8B9CEC25773BC8F5537306EC2C55BD876F25BA6CA37910691E9A79A46888E2CA97DC14C24D5C4FB14D1C10D30E38D40E58EF6540FA5C85061C7E9AB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Currie) {. {-9223372036854775808 34528 0 LMT}. {-2345794528 36000 0 EST}. {-1680508800 39600 1 EST}. {-1669892400 39600 0 EST}. {-1665392400 36000 0 EST}. {-883641600 39600 1 EST}. {-876128400 36000 0 EST}. {-860400000 39600 1 EST}. {-844678800 36000 0 EST}. {-828345600 39600 1 EST}. {-813229200 36000 0 EST}. {47138400 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {89136000 39600 1 EST}. {100022400 36000 0 EST}. {120585600 39600 1 EST}. {131472000 36000 0 EST}. {152035200 39600 1 EST}. {162921600 36000 0 EST}. {183484800 39600 1 EST}. {194976000 36000 0 EST}. {215539200 39600 1 EST}. {226425600 36000 0 EST}. {246988800 39600 1 EST}. {257875200 36000 0 EST}. {278438400 39600 1 EST}. {289324800 36000 0 EST}. {309888000 39600 1 EST}. {320774400 36000 0 EST}. {341337600 39600 1 EST}. {352224000 36000 0 EST}. {3

C:\ProgramData\assignee\tcl\tzdata\Australia\Darwin

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.412182162574068
Encrypted:	false
SSDEEP:	6:SlSWB9X52DCnm2OHPPZUjv02UvVdNcmEcaa9Otvcm9v9tVvcm9vB9pvcm9ubin:MBp52umdHPPZUjc2EV9vM7nFIbi
MD5:	2BDA160D8E23A7CC5D3CDF0232AE9302
SHA1:	9824C861053913E4631F1CE07ED7EAB623EA2ABF
SHA-256:	40E3B8281C5526E972ADE068DD082BE13FC14737E532D719FEE51EDA777BA50E
SHA-512:	23D5205BF415857700DDCD82754296AABEFAB93F2DB0FD3D046CC7169AFC938D26AF48D58EC038DEE60796B65B83F747A95053A3E085F6EC6B21C197EADAC4E4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Darwin) {. {-9223372036854775808 31400 0 LMT}. {-2364108200 32400 0 CST}. {-2230189200 34200 0 CST}. {-1672565340 37800 1 CST}. {-1665390600 34200 0 CST}. {-883639800 37800 1 CST}. {-876126600 34200 0 CST}. {-860398200 37800 1 CST}. {-844677000 34200 0 CST}. {-828343800 37800 1 CST}. {-813227400 34200 0 CST}.}.

C:\ProgramData\assignee\tcl\tzdata\Australia\Eucla

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	714
Entropy (8bit):	4.233531255977267
Encrypted:	false
SSDEEP:	12:MBp527JmdHvOYPJ949U9bkUY9BuwzUpi9gHVKH95u9p99xkxEH9k5qfBhj9klUu:cQ7JemskxUmuwzsv0vUBi0ZhaUu
MD5:	043DE961FC3E7CF42DE47EB25822181A
SHA1:	0C05603FF5C78FC644A34EBBE975B8A28D0057F8
SHA-256:	BD34E0EC50388A2C7C092C5B2A6F90310C3FCF3734DBC80AF0947C3B64CDD931
SHA-512:	97B8D4B895CC95653D713064ED2477D3A57DD1100C0BC8CD81E14E21161E6BBCFF1970A479C69E33E545F12721E40F9EE17DCFDC776474DC1AFBA392B9A3754F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Eucla) {. {-9223372036854775808 30928 0 LMT}. {-2337928528 31500 0 CWST}. {-1672562640 35100 1 CWST}. {-1665387900 31500 0 CWST}. {-883637100 35100 1 CWST}. {-876123900 31500 0 CWST}. {-860395500 35100 1 CWST}. {-844674300 31500 0 CWST}. {-836473500 35100 0 CWST}. {152039700 35100 1 CWST}. {162926100 31500 0 CWST}. {436295700 35100 1 CWST}. {447182100 31500 0 CWST}. {690311700 35100 1 CWST}. {699383700 31500 0 CWST}. {1165079700 35100 1 CWST}. {1174756500 31500 0 CWST}. {1193505300 35100 1 CWST}. {1206810900 31500 0 CWST}. {1224954900 35100 1 CWST}. {1238260500 31500 0 CWST}.}.

C:\ProgramData\assignee\tcl\tzdata\Australia\Hobart

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8049
Entropy (8bit):	3.6471756279058085
Encrypted:	false
SSDEEP:	96:8CsiB8UWKgXyDodb9WNSpK3vfK8z/pCdnoyCD72xeflcIQiq8DHYa:8Cscarb9WNSpKfCiksT
MD5:	49F6270D05867A126F2B252F81F65463
SHA1:	EAAE9712C79FA142978A0F456DA3D24DC1579D84
SHA-256:	35C8A1E33FA041EB6A97ED985455FFB81CABDA00473EE0AA10C1E7443B9509BA
SHA-512:	2E95FD72A1E3C6F6A81E412B6CD3B4D04DB74187CD95D85FF1E4A0D7933156C7136BE16D5F5FA615BE00CEE97F9417C76E771227B800EC0B5DAA995712907E7C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Hobart) {. {-9223372036854775808 35356 0 LMT}. {-2345795356 36000 0 EST}. {-1680508800 39600 1 EST}. {-1669892400 39600 0 EST}. {-1665392400 36000 0 EST}. {-883641600 39600 1 EST}. {-876128400 36000 0 EST}. {-860400000 39600 1 EST}. {-844678800 36000 0 EST}. {-828345600 39600 1 EST}. {-813229200 36000 0 EST}. {-94730400 36000 0 EST}. {-71136000 39600 1 EST}. {-55411200 36000 0 EST}. {-37267200 39600 1 EST}. {-25776000 36000 0 EST}. {-5817600 39600 1 EST}. {5673600 36000 0 EST}. {25632000 39600 1 EST}. {37728000 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {89136000 39600 1 EST}. {100022400 36000 0 EST}. {120585600 39600 1 EST}. {131472000 36000 0 EST}. {152035200 39600 1 EST}. {162921600 36000 0 EST}. {183484800 39600 1 EST}. {194976000 36000 0 EST}. {215539200 39600 1 EST}. {226425600 36000 0 EST}. {24698

C:\ProgramData\assignee\tcl\tzdata\Australia\LHI

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.865814837459796
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIoGEowFVAIgjG/L2DCkx/2DCPGT:MBaIMje0QL2a7
MD5:	1221FC8932CA3DCA431304AF660840F0
SHA1:	5E023E37D98EA1321B10D36A79B26DF1A017F9D5
SHA-256:	EB8FDBCFDE9E2A2AA829E784D402966F61A5BF6F2034E0CB06A24FACB5B87874
SHA-512:	EB19FE74DC13456D0F9F1EDC9C444793A4011D3B65ADF6C7E7A405504079EB3A0C27F69DDA662F797FE363948E93833422F5DC3C1891AA7D414B062BE4DD3887
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Lord_Howe)]} {. LoadTimeZoneFile Australia/Lord_Howe.}.set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe).

C:\ProgramData\assignee\tcl\tzdata\Australia\Lindeman

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	773
Entropy (8bit):	4.103908794545305
Encrypted:	false
SSDEEP:	6:SlSWB9X52DCD2Jm2OHFp5Pn6CIcrWE9/593ZSeE9VerhaYY984B8UpN5Xty/yY1C:MBp52gCmdHVPxCkIr5mGty/yfU85
MD5:	27E062AB8A53A6D9A91DFF5744286EA5
SHA1:	4DCF1439E8774A66418A425FAE96F69BA91FD651
SHA-256:	0586C60A5A8729E70D240638CE79D183127EFBA0B502DA169C97F1D11219055E
SHA-512:	5419BC82EB926FCF7C6D92AAFE7EE40FD584F297ABA2DBFDD5DF596E2F0319853D7F774FB7ADE8FF5A19D3A182031BC6DF44CD61E189CA6D4BDA869D486E6FF1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lindeman) {. {-9223372036854775808 35756 0 LMT}. {-2366790956 36000 0 EST}. {-1672567140 39600 1 EST}. {-1665392400 36000 0 EST}. {-883641600 39600 1 EST}. {-876128400 36000 0 EST}. {-860400000 39600 1 EST}. {-844678800 36000 0 EST}. {-828345600 39600 1 EST}. {-813229200 36000 0 EST}. {31500000 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {625593600 39600 1 EST}. {636480000 36000 0 EST}. {657043200 39600 1 EST}. {667929600 36000 0 EST}. {688492800 39600 1 EST}. {699379200 36000 0 EST}. {709912800 36000 0 EST}. {719942400 39600 1 EST}. {731433600 36000 0 EST}. {751996800 39600 1 EST}. {762883200 36000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\Australia\Lord_Howe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7250
Entropy (8bit):	3.7975760346697753
Encrypted:	false
SSDEEP:	96:zmFP9HsY9BXabBEMlymb1YH3FborMTYuTIDt3Le5+kp/VWeWqQ0I4wgdL:z6L8xymb1YH1bY4GA
MD5:	32E4C89BD2F34380895680188074DB6E
SHA1:	015E2AEB3B4C073E07F511497F3880F02FB5A0E9
SHA-256:	BD49B7213E61175FD9E10D1A73264B63ABEBCA6236B9105B3AD980967F8C75B8
SHA-512:	B190B3F2E5AA5A1D00776B32D6E3CDBA3CEB137C605573B0F3837C03455E5A659463CB63FE30E94E3DC685F86E416E56FC0CCB003855DF8B3C9A7827E8DD486E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lord_Howe) {. {-9223372036854775808 38180 0 LMT}. {-2364114980 36000 0 EST}. {352216800 37800 0 LHST}. {372785400 41400 1 LHST}. {384273000 37800 0 LHST}. {404839800 41400 1 LHST}. {415722600 37800 0 LHST}. {436289400 41400 1 LHST}. {447172200 37800 0 LHST}. {467739000 41400 1 LHST}. {478621800 37800 0 LHST}. {499188600 39600 1 LHST}. {511282800 37800 0 LHST}. {530033400 39600 1 LHST}. {542732400 37800 0 LHST}. {562087800 39600 1 LHST}. {574786800 37800 0 LHST}. {594142200 39600 1 LHST}. {606236400 37800 0 LHST}. {625591800 39600 1 LHST}. {636476400 37800 0 LHST}. {657041400 39600 1 LHST}. {667926000 37800 0 LHST}. {688491000 39600 1 LHST}. {699375600 37800 0 LHST}. {719940600 39600 1 LHST}. {731430000 37800 0 LHST}. {751995000 39600 1 LHST}. {762879600 37800 0 LHST}. {783444600 39600 1 LHST}. {794329200 37800 0 LHST}. {81489

C:\ProgramData\assignee\tcl\tzdata\Australia\Melbourne

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7802
Entropy (8bit):	3.6499304198996323
Encrypted:	false
SSDEEP:	96:s6iB8EWM7yqLdlb9WNSpK3vfK8z/pCdnoyCD72xeflcIQiq8DHYa:s6wzb9WNSpKfCiksT
MD5:	6A5182C785DC33B29363FE96277075F7
SHA1:	EC0C179248A597615AE1CBDD2789CC326CD8FE46
SHA-256:	A68B45E4F92EFF7963AF2F05B05300FA9EAD27BA246D96F9BDFB85C72ADF177B
SHA-512:	39D3F281EFDC9EB63534FED8243ECC455F98F4709CBC0571219D82AB140804AB0DA7837D276EEEAD0D2F425F7730AFB49F552F49AD45D244FD2B1EBD98BCBAD0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Melbourne) {. {-9223372036854775808 34792 0 LMT}. {-2364111592 36000 0 EST}. {-1672567140 39600 1 EST}. {-1665392400 36000 0 EST}. {-883641600 39600 1 EST}. {-876128400 36000 0 EST}. {-860400000 39600 1 EST}. {-844678800 36000 0 EST}. {-828345600 39600 1 EST}. {-813229200 36000 0 EST}. {31500000 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {89136000 39600 1 EST}. {100022400 36000 0 EST}. {120585600 39600 1 EST}. {131472000 36000 0 EST}. {152035200 39600 1 EST}. {162921600 36000 0 EST}. {183484800 39600 1 EST}. {194976000 36000 0 EST}. {215539200 39600 1 EST}. {226425600 36000 0 EST}. {246988800 39600 1 EST}. {257875200 36000 0 EST}. {278438400 39600 1 EST}. {289324800 36000 0 EST}. {309888000 39600 1 EST}. {320774400 36000 0 EST}. {341337600 39600 1 EST}. {352224000 36000 0 EST}. {372787200 39600 1 EST}. {

C:\ProgramData\assignee\tcl\tzdata\Australia\NSW

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.8456659038249
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjREeQWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DC5eDCyu
MD5:	AE3539C49047BE3F8ABAD1AC670975F1
SHA1:	62CD5C3DB618B9FE5630B197AB3A9729B565CA41
SHA-256:	938A557C069B8E0BE8F52D721119CBA9A694F62CF8A7A11D68FD230CC231E17C
SHA-512:	6F143B50C1EEC1D77F87DD5B0FFCF6625800E247400AA58361748BFEA0626E2CDA9C3FD2A4C269B3218D28FF1FB8533F4F6741F6B2C5E83F9C84A5882C86716B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/NSW) $TZData(:Australia/Sydney).

C:\ProgramData\assignee\tcl\tzdata\Australia\North

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.780732237583773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjboFVAIgoXjbhvN2QWCCjsrQWCCjb/:SlSWB9IZaM3yIiFVAIgg2DCZrDCy
MD5:	70EF2A87B4538500CFADB63B62DDCBC6
SHA1:	8D737E6E8D37323D3B41AD419F1CA9B5991E2E99
SHA-256:	59B67F2C7C62C5F9A93767898BA1B51315D2AC271075FAFC1A24313BB673FF27
SHA-512:	E148FC32894A7138D1547910CBD590891120CE5FB533D1348243539C35CE2994DC9F3E7B6A952BF871882C8D6ECA47E13E08AF59AB52A55F790508F2DB9B0EB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Darwin)]} {. LoadTimeZoneFile Australia/Darwin.}.set TZData(:Australia/North) $TZData(:Australia/Darwin).

C:\ProgramData\assignee\tcl\tzdata\Australia\Perth

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.177059373196708
Encrypted:	false
SSDEEP:	12:MBp52wmdHCBdPmRVzEz15zY7aLY6zLAq4z/5fVMBhg8/fp:cQweCBpkY15zY7aLY+LAq4zWhfHp
MD5:	8F23A7EE354F7B471BD0933F7CEEA235
SHA1:	ABE22FEB55079582B90049D98162BEAFACF6E4F1
SHA-256:	241914F22CA6987D8E7222943206CB6A320393ACD7FEAE3C86C520FE653284F0
SHA-512:	F0BDE3FF27B6D9AAB1628452E8F0CF3FC5198E109B12F965E64FD8E411598F3CE4232E52FDC45763F7E7FDC5A5C6CB0CA5DC7FFF8F3A46609C4600907CECDCB3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Perth) {. {-9223372036854775808 27804 0 LMT}. {-2337925404 28800 0 WST}. {-1672559940 32400 1 WST}. {-1665385200 28800 0 WST}. {-883634400 32400 1 WST}. {-876121200 28800 0 WST}. {-860392800 32400 1 WST}. {-844671600 28800 0 WST}. {-836470800 32400 0 WST}. {152042400 32400 1 WST}. {162928800 28800 0 WST}. {436298400 32400 1 WST}. {447184800 28800 0 WST}. {690314400 32400 1 WST}. {699386400 28800 0 WST}. {1165082400 32400 1 WST}. {1174759200 28800 0 WST}. {1193508000 32400 1 WST}. {1206813600 28800 0 WST}. {1224957600 32400 1 WST}. {1238263200 28800 0 WST}.}.

C:\ProgramData\assignee\tcl\tzdata\Australia\Queensland

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.75392731256171
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIaWhvFVAIgPWzCxL2DCoRWJvFBx+DC7W6:MBaIMjoTL2rOvFey
MD5:	D12C6F15F8BFCA19FA402DAE16FC9529
SHA1:	0869E6D11681D74CC3301F4538D98A225BE7C2E1
SHA-256:	77EA0243A11D187C995CE8D83370C6682BC39D2C39809892A48251123FF19A1E
SHA-512:	A98D1AF1FC3E849CCF9E9CC090D3C65B7104C164762F88B6048EA2802F17D635C2E66BE2661338C1DD604B550A267678245DE867451A1412C4C06411A21BE3A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Brisbane)]} {. LoadTimeZoneFile Australia/Brisbane.}.set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane).

C:\ProgramData\assignee\tcl\tzdata\Australia\South

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.701653352722385
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIDRpGvFVAIgSRFL2DCa7QDCuRpv:MBaIMjdp5YFL23QHpv
MD5:	23671880AC24D35F231E2FCECC1A5E3A
SHA1:	5EE2EFD5ADE268B5114EB02FDA77F4C5F507F3CB
SHA-256:	9823032FFEB0BFCE50B6261A848FE0C07267E0846E9F7487AE812CEECB286446
SHA-512:	E303C7DE927E7BAA10EE072D5308FEE6C4E9B2D69DDD8EF014ED60574E0855EE803FE19A7CB31587E62CAE894C087D47A91A130213A24FCCD152736D82F55AB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Adelaide)]} {. LoadTimeZoneFile Australia/Adelaide.}.set TZData(:Australia/South) $TZData(:Australia/Adelaide).

C:\ProgramData\assignee\tcl\tzdata\Australia\Sydney

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7799
Entropy (8bit):	3.643686327072466
Encrypted:	false
SSDEEP:	96:GZNiB81WcyqLdlb9WNSpK3vfK8z/pCdnoyCD72xeflcIQiq8DHYa:GZNJzb9WNSpKfCiksT
MD5:	85A3172865D08EC4794B26FE81A74335
SHA1:	A4AFE77CDDFA14FB8AAD6FEE8E6366C44D36884B
SHA-256:	034A480E29B7C313C3F3D2D7B29657FF2B4935E126E55FAAE8EB122AFB6EB8CD
SHA-512:	346FDB50E9AF053794F9B0DC4B2EEF87D71E89A748B9936B77AFB372538A94A7B66C922A4658246C1738A999C5567DB8CD1BE21AEE1301AB732D1D610F704D22
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Sydney) {. {-9223372036854775808 36292 0 LMT}. {-2364113092 36000 0 EST}. {-1672567140 39600 1 EST}. {-1665392400 36000 0 EST}. {-883641600 39600 1 EST}. {-876128400 36000 0 EST}. {-860400000 39600 1 EST}. {-844678800 36000 0 EST}. {-828345600 39600 1 EST}. {-813229200 36000 0 EST}. {31500000 36000 0 EST}. {57686400 39600 1 EST}. {67968000 36000 0 EST}. {89136000 39600 1 EST}. {100022400 36000 0 EST}. {120585600 39600 1 EST}. {131472000 36000 0 EST}. {152035200 39600 1 EST}. {162921600 36000 0 EST}. {183484800 39600 1 EST}. {194976000 36000 0 EST}. {215539200 39600 1 EST}. {226425600 36000 0 EST}. {246988800 39600 1 EST}. {257875200 36000 0 EST}. {278438400 39600 1 EST}. {289324800 36000 0 EST}. {309888000 39600 1 EST}. {320774400 36000 0 EST}. {341337600 39600 1 EST}. {352224000 36000 0 EST}. {372787200 39600 1 EST}. {386

C:\ProgramData\assignee\tcl\tzdata\Australia\Tasmania

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.7264864039237215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjKD4YFedVAIgoXjKgVAt2QWCCjiiieQWCCjKDvn:SlSWB9IZaM3yI4DVyVAIgxkAt2DC3ne0
MD5:	C7C9CDC9EC855D2F0C23673FA0BAFFB6
SHA1:	4C79E1C17F418CEE4BE8F638F34201EE843D8E28
SHA-256:	014B3D71CE6BD77AD653047CF185EA03C870D78196A236693D7610FED7F30B6F
SHA-512:	79AE11CE076BFB87C0AAD35E9AF6E760FC592F1D086EB78E6DF88744F502ED4248853A0EAD72ADA8EA9583161925802EE5E46E3AA8CE8CF873852C26B4FDC05B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Hobart)]} {. LoadTimeZoneFile Australia/Hobart.}.set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart).

C:\ProgramData\assignee\tcl\tzdata\Australia\Victoria

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.7697171393457936
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIvFfkvFVAIgoFFL2DCzyQDCMFB:MBaIMj9fHaFL2xQzB
MD5:	BD2EA272B8DF472E29B7DD0506287E92
SHA1:	55BF3A3B6398F9FF1DB3A46998A4EFF44F6F325C
SHA-256:	EE35DF8BBCD6A99A5550F67F265044529BD7AF6A83087DD73CA0BE1EE5C8BF51
SHA-512:	82B18D2C9BA7113C2714DC79A87101FFB0C36E5520D61ADEAB8A31AD219E51A6402A6C8A8FD7120A330FE8847FF8F083397A1BF5889B73484FBAA6F99497DE48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Melbourne)]} {. LoadTimeZoneFile Australia/Melbourne.}.set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne).

C:\ProgramData\assignee\tcl\tzdata\Australia\West

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.781808870279912
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjXFedVAIgoXjbOAt2QWCCjH0QWCCj5:SlSWB9IZaM3yIYVAIg9At2DC00DCa
MD5:	9E0EF0058DDA86016547F2BFE421DE74
SHA1:	5DB6AEAC6B0A42FEAE28BB1A45679BC235F4E5BF
SHA-256:	FC952BE48F11362981CDC8859F9C634312E5805F2F1513159F25AEFCE664867C
SHA-512:	C60E5A63378F8424CE8D862A575DFE138646D5E88C6A34562A77BEC4B34EA3ED3085424E2130E610197164C7E88805DC6CDE46416EB45DC256F387F632F48CA7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Perth)]} {. LoadTimeZoneFile Australia/Perth.}.set TZData(:Australia/West) $TZData(:Australia/Perth).

C:\ProgramData\assignee\tcl\tzdata\Australia\Yancowinna

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.871861105493913
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIcKCFVAIgJKfF2DCkuM0DC9Kl:MBaIMjcKCQJKt2kVSKl
MD5:	5C3CED24741704A0A7019FA66AC0C0A1
SHA1:	88C7AF3B22ED01ED99784C3FAB4F5112AA4659F3
SHA-256:	71A56C71CC30A46950B1B4D4FBB12CB1CBAA24267F994A0F223AE879F1BB6EEC
SHA-512:	771A7AC5D03DD7099F565D6E926F7B97E8A7BA3795339D3FD78F7C465005B55388D8CC30A62978042C354254E1BA5467D0832C0D29497E33D6EF1DA217528806
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Broken_Hill)]} {. LoadTimeZoneFile Australia/Broken_Hill.}.set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill).

C:\ProgramData\assignee\tcl\tzdata\Brazil\Acre

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.84045343046357
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sMhS4edVAIg20sMhStQ1bNW1h4IAcGEsMhSA:SlSWB9IZaM3y7thtedVAIgpthKQxWh4y
MD5:	DF4D752BEEAF40F081C03B4572E9D858
SHA1:	A83B5E4C3A9EB0CF43263AFF65DB374353F65595
SHA-256:	1B1AD73D3FE403AA1F939F05F613F6A3F39A8BA49543992D836CD6ED14B92F2C
SHA-512:	1F96F1D8AACD6D37AC13295B345E761204DAE6AA1DF4894A11E00857CCB7247FA7BEBD22407EA5D13193E2945EB1F4210E32669069F157F1459B26643A67F445
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco).

C:\ProgramData\assignee\tcl\tzdata\Brazil\DeNoronha

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.826795532956443
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0wKy4oedVAIg20wK+F1bIAJl0IAcGEwKyvn:SlSWB9IZaM3y7/rDdVAIgp/mxIAE90/8
MD5:	86B9E49F604AD5DBC4EC6BA735A513C7
SHA1:	BE3AB32339DF9830D4F445CCF883D79DDBA8708E
SHA-256:	628A9AE97682B98145588E356948996EAE18528E34A1428A6B2765CCAA7A8A1F
SHA-512:	EE312624EC0193C599B2BDBFA57CC4EA7C68890955E0D888149172DF8F2095C553BFBB80BF76C1B8F3232F3A5863A519FF59976BBAEA622C64737890D159AA22
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Noronha)]} {. LoadTimeZoneFile America/Noronha.}.set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha).

C:\ProgramData\assignee\tcl\tzdata\Brazil\East

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.9019570219911275
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tQJXvedVAIg20tQJX1bJHIAcGEtQJXv:SlSWB9IZaM3y7tIGdVAIgptExR90tIv
MD5:	FBF6B9E8B9C93B1B9E484D88EF208F38
SHA1:	44004E19A485B70E003687CB1057B8A2421D1BF0
SHA-256:	C89E831C4A0525C3CEFF17072843386369096C08878A4412FB208EF5D3F156D8
SHA-512:	4E518FC4CED0C756FF45E0EDE72F6503C4B3AE72E785651DE261D3F261D43F914721EFCEAB272398BC145E41827F35D46DE4E022EAF413D95F64E8B3BD752002
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Sao_Paulo)]} {. LoadTimeZoneFile America/Sao_Paulo.}.set TZData(:Brazil/East) $TZData(:America/Sao_Paulo).

C:\ProgramData\assignee\tcl\tzdata\Brazil\West

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.853909262702622
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0znQZFwFVAIg20znQoCxL1bbAWVIAcGEznQb:SlSWB9IZaM3y7zn+wFVAIgpznzCxLxnJ
MD5:	116F0F146B004D476B6B86EC0EE2D54D
SHA1:	1F39A84EF3DFF676A844174D9045BE388D3BA8C0
SHA-256:	F24B9ED1FAFA98CD7807FFFEF4BACA1BCE1655ABD70EB69D46478732FA0DA573
SHA-512:	23BD7EC1B5ADB465A204AAA35024EE917F8D6C3136C4EA973D8B18B586282C4806329CEBE0EDBF9E13D0032063C8082EC0D84A049F1217C856943A4DDC4900D0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Manaus)]} {. LoadTimeZoneFile America/Manaus.}.set TZData(:Brazil/West) $TZData(:America/Manaus).

C:\ProgramData\assignee\tcl\tzdata\CET

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	3.710275786382764
Encrypted:	false
SSDEEP:	96:ht6CvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:PSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	AE72690EF7063F0B9F640096204E2ECE
SHA1:	4F815B51DA9BCA97DFF71D191B74D0190890F946
SHA-256:	BB2C5E587EE9F9BF85C1D0B6F57197985663D4DFF0FED13233953C1807A1F11C
SHA-512:	F7F0911251BC7191754AF0BA2C455E825BF16EA9202A740DC1E07317B1D74CDAF680E161155CC1BD5E862DCEE2A58101F419D8B5E0E24C4BA7134999D9B55C48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:CET) {. {-9223372036854775808 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766623600 3600 0 CET}. {228877200 7200 1 CEST}. {243997200 3600 0 CET}. {260326800 7200 1 CEST}. {276051600 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET

C:\ProgramData\assignee\tcl\tzdata\CST6CDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.723597525146651
Encrypted:	false
SSDEEP:	192:KxrIOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbo:KxrIOdXkqbfNTzZSJw5/9/yuvQ6crD5r
MD5:	B5AC3FA83585957217CA04384171F0FF
SHA1:	827FF1FBDADDDE3754453E680B4E719A50499AE6
SHA-256:	17CBE2F211973F827E0D5F9F2B4365951164BC06DA065F6F38F45CB064B29457
SHA-512:	A56485813C47758F988A250FFA97E2DBD7A69DDD16034E9EF2834AF895E8A374EEB4DA3F36E6AD80285AC10F84543ECF5840670805082E238F822F85D635651F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:CST6CDT) {. {-9223372036854775808 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-84384000 -18000 1 CDT}. {-68662800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -216

C:\ProgramData\assignee\tcl\tzdata\Canada\Atlantic

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.754307292225081
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx02NEO4FVAIg202NEtYF0nalGe2IAcGE2NEOv:SlSWB9IZaM3y7UEO4FVAIgpUEqF0af2b
MD5:	B0E220B9CD16038AAF3EA21D60064B62
SHA1:	333410CB7D4F96EF836CDC8097A1DCE34A2B961A
SHA-256:	6F71D7ED827C9EF6E758A44D2A998673E1225EB8005AD557A1713F5894833F92
SHA-512:	F879F60E36C739280E8FC255D2792BB24BCA90A265F8F90B5FB85630D5A58CE4FDBD24EA5594924375C3CD31DBC6D49C06CBFA43C52D0B9A1E9D799914A164F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:Canada/Atlantic) $TZData(:America/Halifax).

C:\ProgramData\assignee\tcl\tzdata\Canada\Central

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.814426408072182
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0po4FVAIg20peRL0nPQox/h4IAcGEpov:SlSWB9IZaM3y7phFVAIgppOL0d490py
MD5:	8374E381BC8235B11B7C5CA215FA112C
SHA1:	181298556253D634B09D72BD925C4DBB92055A06
SHA-256:	1B87273B264A3243D2025B1CFC05B0797CBC4AA95D3319EEE2BEF8A09FDA8CAD
SHA-512:	12800E49B8094843F66454E270B4BE154B053E5FB453C83269AF7C27B965071C88B02AF7BB404E7F5A07277DB45E58D1C5240B377FC06172087BB29749C7543B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Winnipeg)]} {. LoadTimeZoneFile America/Winnipeg.}.set TZData(:Canada/Central) $TZData(:America/Winnipeg).

C:\ProgramData\assignee\tcl\tzdata\Canada\East-Saskatchewan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.860347334610986
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nbP2/8S64IAcGEsAz1:SlSWB9IZaM3y7hzipVAIgphzGCW60L5X
MD5:	F5CB42BC029315088FAD03C9235FFB51
SHA1:	7773ECE0B85D66E4FA207A26EE4395F38BAC4068
SHA-256:	AF04A4558E31C9864B92FE3403011F7A2FBD837E1314A7BB5AF552D5AED06457
SHA-512:	0533B9D98834866FAA3C6E67A6F61A8A22C2BFDBA8C5336388C0894FBA550611C9112515F17E20E7B3508EC2318D58EA7CA814EC10C3451954C3CC169EDA0F8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina).

C:\ProgramData\assignee\tcl\tzdata\Canada\Eastern

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.7067203041014185
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI60nbHboxp4IAcGEqMKLRXv:SlSWB9IZaM3y7RQ+VAIgpRQ+60Dboxp2
MD5:	22453AC70F84F34868B442E0A7BDC20A
SHA1:	730049FF6953E186C197601B27AB850305961FD0
SHA-256:	545B992E943A32210F768CB86DEF3203BE956EE03A3B1BC0D55A5CD18A4F064D
SHA-512:	91FE33FAD3954019F632A771BCBD9FF3FDCCDA1F51DD25E0E5808A724F2D9B905E5E2DEE32D415BEA9A9ADB74186D83548584414BB130DF1A166D49373AC7BEF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:Canada/Eastern) $TZData(:America/Toronto).

C:\ProgramData\assignee\tcl\tzdata\Canada\Mountain

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.768148288986999
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx07nKL5zFVAIg207nKLKN0nNYLo/4IAcGE7nKLun:SlSWB9IZaM3y77GzFVAIgp7DN0W8/49s
MD5:	5E0D3D1A7E9F800210BB3E02DFF2ECD3
SHA1:	F2471795A9314A292DEAA3F3B94145D3DE5A2792
SHA-256:	A8B3A4D53AA1CC73312E80951A9E9CEA162F4F51DA29B897FEB58B2DF3431821
SHA-512:	F80C7CDFE20E5FAD9E4BA457446F067ACE0C3F4659761E3B4A2422D3456CDE92C20589954DE5E0DC64619E3B6AB3A55AE0E0E783F8EFB24D74A5F6DFBF5ABB16
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Edmonton)]} {. LoadTimeZoneFile America/Edmonton.}.set TZData(:Canada/Mountain) $TZData(:America/Edmonton).

C:\ProgramData\assignee\tcl\tzdata\Canada\Newfoundland

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.953647576523321
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tVZMYFwFVAIg20tVZoYvxL0nJBJi6FBx/2IAcGEt3:SlSWB9IZaM3y7tgYmFVAIgptMqL0xdB7
MD5:	3A4E193C8624AE282739867B22B7270A
SHA1:	AC93EEDA7E8AB7E40834FFBA83BAE5D803CB7162
SHA-256:	70EF849809F72741FA4F37C04C102A8C6733639E905B4E7F554F1D94737BF26B
SHA-512:	BE2AACEE2A6F74520F4F1C0CCBBB750ED6C7375D4368023BAB419184F8F717D52981106C03F487B24A943907E60784136C0E5F8C1D5B3D1C67C20E23A4F412B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/St_Johns)]} {. LoadTimeZoneFile America/St_Johns.}.set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns).

C:\ProgramData\assignee\tcl\tzdata\Canada\Pacific

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.839589386398345
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0oELSTAWFwVAIg20oELSTAQO0L0nie2IAcGEoELSTH:SlSWB9IZaM3y7ZLgXwVAIgpZLgJJL0Nu
MD5:	6AA0FCE594E991D6772C04E137C7BE00
SHA1:	6C53EE6FEBEC2BD5271DD80D40146247E779CB7B
SHA-256:	D2858621DA914C3F853E399F0819BA05BDE68848E78F59695B84B2B83C1FDD2A
SHA-512:	7B354BB9370BB61EB0E801A1477815865FDE51E6EA43BF166A6B1EED127488CC25106DEE1C6C5DC1EF3E13E9819451E10AFBC0E189D3D3CDE8AFFA4334C77CA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Vancouver)]} {. LoadTimeZoneFile America/Vancouver.}.set TZData(:Canada/Pacific) $TZData(:America/Vancouver).

C:\ProgramData\assignee\tcl\tzdata\Canada\Saskatchewan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.83938055689947
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nogS64IAcGEsAzEun:SlSWB9IZaM3y7hzipVAIgphzGCW60Hd9
MD5:	927FD3986F83A60C217A3006F65A3B0A
SHA1:	022D118024BFC5AE0922A1385288C3E4B41903DB
SHA-256:	BB457E954DB625A8606DD0F372DA9BFFAA01F774B4B82A2B1CEE2E969C15ABC3
SHA-512:	3EA932FA5416A9C817977F9D31C8A15C937A453B4D6A6409A7966E76D66A685C91F1117C82BEBEBA2AF5516556DA2BDEC898AD718C78FB8B690F31692174DA6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/Saskatchewan) $TZData(:America/Regina).

C:\ProgramData\assignee\tcl\tzdata\Canada\Yukon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.841592909599599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0peR2pVkvFVAIg20peR2zxL0nTOK8x/h4IAcGEpeRu:SlSWB9IZaM3y7peR2fkvFVAIgppeR2FF
MD5:	9F2A7F0D8492F67F764F647638533C3F
SHA1:	3785DACD1645E0630649E411DC834E8A4FB7F40B
SHA-256:	F2A81B7E95D49CEC3C8952463B727129B4DC43D58ADC64BB7CAB642D3D191039
SHA-512:	0133870BB96851ECD486D55FD10EB4BCB1678772C1BFFADE85FC5644AC8445CDB4C6284BEFFED197E9386C9C6EF74F5F718F2CB43C4C7B8E65FE413C8EC51CD0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Whitehorse)]} {. LoadTimeZoneFile America/Whitehorse.}.set TZData(:Canada/Yukon) $TZData(:America/Whitehorse).

C:\ProgramData\assignee\tcl\tzdata\Chile\Continental

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.762021566751952
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tfEJ5YyVAIg20tfEJvYvWAt0dKLRMyREGH/h4IAcB:SlSWB9IZaM3y7tfEJHVAIgptfEJAvN0+
MD5:	B2BDB6C027FF34D624EA8B992E5F41AB
SHA1:	425AB0D603C3F5810047A7DC8FD28FDF306CC2DB
SHA-256:	F2E3C1E88C5D165E1D38B0D2766D64AA4D2E6996DF1BE58DADC9C4FC4F503A2E
SHA-512:	6E5A8DC6F5D5F0218C37EE719441EBDC7EDED3708F8705A98AEF7E256C8DC5D82F4BF82C529282E01D8E6E669C4F843B143730AD9D8BBF43BCC98ECB65B52C9B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Santiago)]} {. LoadTimeZoneFile America/Santiago.}.set TZData(:Chile/Continental) $TZData(:America/Santiago).

C:\ProgramData\assignee\tcl\tzdata\Chile\EasterIsland

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.758503564906338
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG7ZAJpVAIgObT7ZA6xL0bxOdBx/nUDH7ZAen:SlSWB9IZaM3ycJA3VAIgObJA6xL04dB4
MD5:	E9DF5E3D9E5E242A1B9C73D8F35C9911
SHA1:	9905EF3C1847CFF8156EC745779FCF0D920199B7
SHA-256:	AA305BEC168C0A5C8494B81114D69C61A0D3CF748995AF5CCC3E2591AC78C90C
SHA-512:	7707AC84D5C305F40A1713F1CBBED8A223553A5F989281CCDB278F0BD0D408E6FC9396D9FA0CCC82168248A30362D2D4B27EDEF36D9A3D70E286A5B668686FDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Easter)]} {. LoadTimeZoneFile Pacific/Easter.}.set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter).

C:\ProgramData\assignee\tcl\tzdata\Cuba

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.8073098952422395
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx02TEMVFwVAIg202TEKN0lIAcGE2TEMv:SlSWB9IZaM3y76EHVAIgp6EKN0l906Eu
MD5:	BA8EE8511A2013E791A3C50369488588
SHA1:	03BF30F56FB604480A9F5ECD8FB13E3CF82F4524
SHA-256:	2F9DFE275B62EFBCD5F72D6A13C6BB9AFD2F67FDDD8843013D128D55373CD677
SHA-512:	29C9E9F4B9679AFD688A90A605CFC1D7B86514C4966E2196A4A5D48D4F1CF16775DFBDF1C9793C3BDAA13B6986765531B2E11398EFE5662EEDA7B37110697832
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Havana)]} {. LoadTimeZoneFile America/Havana.}.set TZData(:Cuba) $TZData(:America/Havana).

C:\ProgramData\assignee\tcl\tzdata\EET

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7189
Entropy (8bit):	3.6040923024580884
Encrypted:	false
SSDEEP:	96:WB8kMKVCy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lf:AroXPzh2kNU4tB715pyzHy1gA
MD5:	9AE4C7EC014649393D354B02DF00F8B9
SHA1:	D82195DEF49CFFEAB3791EA70E6D1BB8BC113155
SHA-256:	4CB6582052BE7784DD08CE7FD97ACC56234F07BCF80B69E57111A8F88454908E
SHA-512:	6F0C138AF98A4D4A1028487C29267088BD4C0EC9E7C1DB9818FA31A61C9584B67B3F5909C6E6FDB0F7183629E892A77BA97654D39FCE7DDEF6908F8146B7BE72
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EET) {. {-9223372036854775808 7200 0 EET}. {228877200 10800 1 EEST}. {243997200 7200 0 EET}. {260326800 10800 1 EEST}. {276051600 7200 0 EET}. {291776400 10800 1 EEST}. {307501200 7200 0 EET}. {323830800 10800 1 EEST}. {338950800 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}.

C:\ProgramData\assignee\tcl\tzdata\EST

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.879680803636454
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yLWkXGm2OHLVvain:SlSWB9X5y2m2OHLViin
MD5:	33221E0807873CC5E16A55BF4450B6D4
SHA1:	A01FD9D1B8E554EE7A25473C2FBECA3B08B7FD02
SHA-256:	5AA7D9865554BCE546F1846935C5F68C9CA806B29B6A45765BA55E09B14363E4
SHA-512:	54A33B239BBFCFC645409FBC8D9DDBFCAE56067FA0427D0BE5F49CB32EB8EEC8E43FC22CE1C083FDC17DD8591BE9DB28A2D5006AFA473F10FB17EF2CE7AED305
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EST) {. {-9223372036854775808 -18000 0 EST}.}.

C:\ProgramData\assignee\tcl\tzdata\EST5EDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.723178863172678
Encrypted:	false
SSDEEP:	96:W4UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Cwdrn+qvOTFhPI1jFIL
MD5:	1A7BDED5B0BADD36F76E1971562B3D3B
SHA1:	CF5BB82484C4522B178E25D14A42B3DBE02D987D
SHA-256:	AFD2F12E50370610EA61BA9DD3838129785DFDEE1EBCC4E37621B54A4CF2AE3F
SHA-512:	4803A906E2C18A2792BF812B8D26C936C71D8A9DD9E87F7DA06630978FCB5DE1094CD20458D37973AA9967D51B97F94A5785B7B15F807E526C13D018688F16D9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EST5EDT) {. {-9223372036854775808 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -180

C:\ProgramData\assignee\tcl\tzdata\Egypt

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.812476042768195
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsPHVyVAIgNGE7JW6yCh0DcPHv:SlSWB9IZaM3y7AVAIgNTFW6yg0DY
MD5:	3708D7ED7044DE74B8BE5EBD7314371B
SHA1:	5DDC75C6204D1A2A59C8441A8CAF609404472895
SHA-256:	07F4B09FA0A1D0BA63E17AD682CAD9535592B372815AB8FD4884ACD92EC3D434
SHA-512:	A8761601CD9B601E0CE8AC35B6C7F02A56B07DC8DE31DEB99F60CB3013DEAD900C74702031B5F5F9C2738BA48A8420603D46C3AE0E0C87D40B9D9D44CE0EAE81
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Cairo)]} {. LoadTimeZoneFile Africa/Cairo.}.set TZData(:Egypt) $TZData(:Africa/Cairo).

C:\ProgramData\assignee\tcl\tzdata\Eire

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.85316662399069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV5QH+owFVAIgoq6QH7W6yMQs/h8QanQHpn:SlSWB9IZaM3ymnQeowFVAIgonQbNyM/R
MD5:	AA0DEB998177EB5208C4D207D46ECCE3
SHA1:	DD8C7CE874EE12DD77F467B74A9C8FC74C7045FF
SHA-256:	16A42F07DE5233599866ECC1CBB1FC4CD4483AC64E286387A0EED1AFF919717D
SHA-512:	D93A66A62304D1732412CAAAB2F86CE5BCD07D07C1315714D81754827D5EFD30E36D06C0DC3CF4A8C86B750D7D6A144D609D05E241FADC7FF78D3DD2044E4CBB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Dublin)]} {. LoadTimeZoneFile Europe/Dublin.}.set TZData(:Eire) $TZData(:Europe/Dublin).

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.883978227144926
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDMWkXGm2OHvDd:SlSWB9X5yRQCm2OHB
MD5:	94CDB0947C94E40D59CB9E56DB1FA435
SHA1:	B73907DAC08787D3859093E8F09828229EBAA6FD
SHA-256:	17AF31BD69C0048A0787BA588AD8641F1DC000A8C7AEC66386B0D9F80417ABBF
SHA-512:	5F47A2864F9036F3FD61FC65ED4969330DD2A1AC237CB2BD8E972DDFED75120D8D377D5C84060015DCFC163D03F384DC56DC8C6F29E65528C04F1FDA8BBC688E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT) {. {-9223372036854775808 0 0 GMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+0

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.862090278972909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDOm7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRSw8RQvn
MD5:	4AC2027A430A7343B74393C7FE1D6285
SHA1:	C675A91954EC82EB67E1B7FA4B0C0ED11AAF83DA
SHA-256:	01EEF5F81290DBA38366D8BEADAD156AAC40D049DBFA5B4D0E6A6A8641D798D1
SHA-512:	61943A348C4D133B0730EAA264A15EF37E0BBE2F767D87574801EAAA9A457DA48D854308B6ABADA21D33F4D498EB748BCB66964EB14BB8DC1367F77A803BA520
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT+0) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+1

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.981349705962426
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOvedSXGm2OH1VnYAv:SlSWB9X5yRSvwJm2OH1VnYK
MD5:	ED439FA2D62624D9616CF1F87C850EA1
SHA1:	D0CF000B89433BF245BD58EB644067B37E108B42
SHA-256:	5E32300CC20CB5CE61BBEFA37D547F765F8B22D9085AD24FC2BA6358233BD0ED
SHA-512:	45D6B20C12FE921A2ACA7EB07792C2F7F4EC77279CF76AA8623F8DC23A306699DAB4920233D8597F7DF5661120F3AC555DBC6C5E72291C5277D102317BC7E008
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+1) {. {-9223372036854775808 -3600 0 GMT+1}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+10

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.95989422353511
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOgFkXGm2OH1VyMVCC:SlSWB9X5yRS0m2OH1VyMh
MD5:	AA3C84567F89D180FA967A8E01ED8DB3
SHA1:	1B076494BFAAB46178EFC9602B4CF5E2A62BB6B1
SHA-256:	E6DA2EFC31F04D6C9DFC594D99B4499320D674B00F2A17401792CF663810BFB4
SHA-512:	0F101632AF981E53C0063B59A580034DE789DB4205EDCF7228CF510470AFDF9BFBE17B03C6A4EFA8E5C180F7869F3DE0AE97514D026772734624185B6E826D43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+10) {. {-9223372036854775808 -36000 0 GMT+10}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+11

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.9977421504796204
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOeLXGm2OHaFUYK:SlSWB9X5yRShm2OHaFUL
MD5:	F57A7F84AA6542BBBD7212461380D463
SHA1:	FD192ADF297C09F38312D668E2E2AB569F72544E
SHA-256:	008A6C934B494644990D6A01BA112AFF7C957112EA21276F959B28E3128CB7A6
SHA-512:	ADBC6F509C9745FFC511662D403FC0FABF87C01E2D0F03741D2B10CA1C434890F16F028B9D2D8A7397F156B0EC69438DD4C1A24F675BC113523D9D6DC444646A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+11) {. {-9223372036854775808 -39600 0 GMT+11}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+12

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.973993120288556
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOK/kXGm2OH3FNYMXL:SlSWB9X5yRSKTm2OH3XYM7
MD5:	F2E06CB22EECFCFBF8E6A896CB93D70D
SHA1:	0D6759F9538F9CC7EC4799E80047279C5765FE8F
SHA-256:	3298FBCA6673EA9068CBE030FC6CE663615482C2691BC3FEF0D0C6DCD080749C
SHA-512:	7DEDC53220D6415AE0FE3422C8F2B40F808F8B1BF95DDE24849C1E9834ACD937FA4C702AD20F6D2BCD100CB4450B86FA7A2625F3A55A1B1A8CC4F39383212629
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+12) {. {-9223372036854775808 -43200 0 GMT+12}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+2

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.921571940456554
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOcFwFFkXGm2OHnF6PCYv:SlSWB9X5yRS0wTm2OHnF6qYv
MD5:	194AF292B3A65A1391A5476B3811EB8E
SHA1:	5DF209458579985955747400645FFBD0E06F2CAE
SHA-256:	56E4205B1BA0C815A557405A270D0A776D1DBC617B493BF7560884358EC694E4
SHA-512:	C2DC980D11604732EB51367008D591C66FB9A8576392A948928CE2C86F6CE7836EA1BDCB2B9F9CF5A1711DA0D6E5AB3E08C433B4D3BA01E68106013A0AE14ED5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+2) {. {-9223372036854775808 -7200 0 GMT+2}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+3

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.9509374397671495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOCcXGm2OHBFV9bv:SlSWB9X5yRSCTm2OHBFHL
MD5:	F42335C352D791F43042817F35D00440
SHA1:	7FFD4B1795F2274C4D8B9F0D67E85717149CF548
SHA-256:	C204EBC932DDB49E52B644E1E477037F180453FA46FF580288848845871CDFA0
SHA-512:	7E4CF5DE538989958779517FE6B13F378F2F5AF26742FA6E835E91A3AF379DBAFACB9588CD76E0922E5239D829E73FE26ECA81E46E9661C945A88E150F152A79
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+3) {. {-9223372036854775808 -10800 0 GMT+3}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+4

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.971905505780861
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOqLXGm2OHBv6CCn:SlSWB9X5yRStm2OHBrCn
MD5:	7877557A521A40EEC80EFCA08BE5A297
SHA1:	78060A958658A89BA77D30D0B07EF2ABBF1AFFC7
SHA-256:	9F05B6BDEF3FEF571368024CC6FCDEB64327EF9037CE1C4293BBE73569020DBF
SHA-512:	B58375FADC724DC8E639B74B7148D1BEC34622D56781A4C08780DF375C9579898E9FA2FECF5D87835A645A82037425A8015347632EAAFC77429D63A4C7AC2BB4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+4) {. {-9223372036854775808 -14400 0 GMT+4}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+5

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.958435272857266
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOEkXGm2OHLVvYIYKn:SlSWB9X5yRSQm2OHLVgIYKn
MD5:	D0DD197A220CA142CA7301E96949B8BA
SHA1:	F194CD411BDD88BC6DBA4ECE766400A5DB1E9C94
SHA-256:	C917E4106DCC23C56FC9152CF8F4ACDEB4C2B20D8CF5D1952CB4580669D23CF7
SHA-512:	78F08ECE3A378F6B482631A0CB12CAAEB632E21C3B4667E72AC452FBF534F7141D0E642EBF5211143847AE817086610C51957CE0B50DF7840CAF614EE79E4CCE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+5) {. {-9223372036854775808 -18000 0 GMT+5}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+6

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.975103119610687
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOAkEXGm2OHvTYLn:SlSWB9X5yRSbLm2OHvon
MD5:	2F009759072B1C9618B8B341B5C1BA30
SHA1:	1312EF4DBEEB3C14F63946E0D4C85B2F19FB9475
SHA-256:	9569BAEF38EBB61AB03FBCB21A7DAECDA6B8AD78E04A070487A9284B90912FA7
SHA-512:	04F954F682361C78BA7F049ADE56695DBAB73F280240FF94085E7A7CF936C5A5B8C4817FA72F24C5E0F4D2D83F199CCEC05AC2AD2D694FBF0E2B3863E87012FB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+6) {. {-9223372036854775808 -21600 0 GMT+6}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+7

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.929319953392498
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDONedFkXGm2OHrXVyKCCn:SlSWB9X5yRSNwJm2OHrIKCCn
MD5:	76B1E98F1A44D82BB4774A33AD3939CD
SHA1:	92ACB2E264A7ADBF1D11AEFE0835812CEEBAB4E2
SHA-256:	E89A30F5F06A4D125A5FE01582D5BD2A9E8560606051E9CAE371080036DCDA51
SHA-512:	11DC75995DB895B881EAACB448831AD06EF17CBCD98979205AA183E0A77E22EE7227E44F03C0BA8A4C517F2983D71AB3B8029D07D7D6F8230A78A4F3112B6C5C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+7) {. {-9223372036854775808 -25200 0 GMT+7}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+8

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.914606655117358
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOOFwFSXGm2OHmFv2L:SlSWB9X5yRSqwTm2OHa6
MD5:	49805E413F1C268385B6B3F7BA5C86F3
SHA1:	6AF7D03B95AAB61E3C178E0834865FE9DC6F7C84
SHA-256:	F92A34D7C091DC889A850266F98DA61A7355CF9F5C1D7A3E928D9735E5471C37
SHA-512:	E4B2357395876CD716E28C2C565108E5F7A329DB487C1E6BE9F42FAF1E9F6394AF27A79FC4263C2FA0D5D530898361C3EF94011C92EFA45CCCA5FEBB71439828
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+8) {. {-9223372036854775808 -28800 0 GMT+8}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT+9

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.957559259961566
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOwcXGm2OHNXYvC:SlSWB9X5yRSwTm2OHNXYvC
MD5:	027D08D52DB32055C8428EF85747392C
SHA1:	28C3AAEC73B42AEFB9A0122B4EAA613609F4F307
SHA-256:	55D9AF430A84E0CA6C859ED54D8401F06BC84EE7F2D096315AF9BE100A0BCFCF
SHA-512:	CDA1B2F4E865420EA7E48BA25ABE712C976434729E3D9F843D41CFBA57CD563202ED0E5E6BC2F10AB457921F6DB2C374CBFA6C8753C2D913B7AC35944C362986
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+9) {. {-9223372036854775808 -32400 0 GMT+9}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-0

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.849103265985896
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDIyHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRUyJ8RQvn
MD5:	FA608B6E2F9D0E64D2DF81B277D40E35
SHA1:	55A7735ACCF6A759D2069388B2943323E23EE56D
SHA-256:	48A929080C1E7C901246DC83A7A7F87396EAF9D982659460BF33A85B4C3FAE64
SHA-512:	35A8899B7084E85165886B07B6DD553745558EAF4297F702829A08BF71E5AA18790F0D02229093FA42515C97A1DDA7292F4D019DDB1251370D9896E94738D32A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT-0) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-1

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.940990471370115
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDI4cXGm2OHMXCC:SlSWB9X5yRU4Tm2OH+CC
MD5:	35191A690478566C32EFFB89C932CA1A
SHA1:	BBECD25C5CD4C57D4852FF81916BFDB578F525FC
SHA-256:	E4C16621152E4D169D54B9BDF7EB620D42AA13271B7871BA2A84474C9CD57CDC
SHA-512:	C885AA33781930B743AB905228D7C62D4902BA40187C9C885742A0930368112F341B26458CF15F8BEFE8784A55F09B33AF2153516108487E4B9405FCF7ECD425
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-1) {. {-9223372036854775808 3600 0 GMT-1}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-10

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.920071111791664
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDINFedFkXGm2OHM46yAvn:SlSWB9X5yRUNCm2OH76yKn
MD5:	9CB9B7A8EE862000C70E4BC466A18EE6
SHA1:	69193A681FB46D60502E83BAAC317F5C8E2EC00A
SHA-256:	64D00ECCCD371DEDC4612349BF45D74250FC181444B826F881FFCA8A6EB98955
SHA-512:	0766B09ECBD09862BEF99F39DC54BEEF8E9DD855F4E29492939B0064A04FC418BF512E88CAD9B422BB15D8E92DDCA29F07CB2CFBF66D48FDE7AEFBC06E79ADFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-10) {. {-9223372036854775808 36000 0 GMT-10}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-11

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.958248151144388
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIVEXGm2OHlVNZYvn:SlSWB9X5yRUVLm2OHlVNmvn
MD5:	15CB95F32B63B0C716DF33A679636F61
SHA1:	2BC6F5E38606A1768332B9F7B555A4BFE1FE36CF
SHA-256:	F5FFD3645880E0E9122EF69154BB53E0286EEDA2C72E15D9BCC0404A5A73DFB6
SHA-512:	A7CF4B482E27D1EAA24DE742DE0C55A2FB24E73459C72AB2E32021CBE33CCDF3DAAA9DA6BDFBA64EECA4A9DE82A48389113C32ACD26E846FE763C1FB2C46DF7F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-11) {. {-9223372036854775808 39600 0 GMT-11}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-12

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.934292607647314
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIjWkXGm2OHwvvY6rvn:SlSWB9X5yRUjCm2OHwvvY67n
MD5:	6AA77D46D0974A188D428700C8DC4E05
SHA1:	248A4DB238B9BEDB203D4103832381E2EDFD13E3
SHA-256:	E7633C7DBF90EAC93FC41FAF61967E59E58DCE488A1FF59B470037E5015016EC
SHA-512:	57EAF2E484EAF1900B8B13A56F507477EFFD6EEE32EC1609F67F3EA2B11B3990147283B57C6E302A8F4F496027B2EB0246FD937AC06538CD90DB7A7FB1DA2FA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-12) {. {-9223372036854775808 43200 0 GMT-12}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-13

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.95081551660288
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIsXGm2OH1dNvHfAvn:SlSWB9X5yRUjm2OH14vn
MD5:	9A9C9E57377EEFD46EBD181D806F7C4C
SHA1:	194DAC7F06D5E7876C25BF57033DC48CFCAAEDD2
SHA-256:	6682057C84F2C6EEA1B79FBB4083E9BC8BA5341E18107EA187523FAF8473747F
SHA-512:	3517516C0154240E6481EA49DFE62EF0039D272CDB35AB3C6FC991C240F37EC32ED298663D290D80FE58F6ADD7FAE5FAC6D2D79D0CA2507FD50234DE562F1C18
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-13) {. {-9223372036854775808 46800 0 GMT-13}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-14

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.945988068238153
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIxmcXGm2OH0FVF+K:SlSWB9X5yRUxmTm2OH8/+K
MD5:	8F531FD9B050E20FAA5B8EE1E7B3BF72
SHA1:	9648D6B1B0C262F011CF1B0BE73F494208F41DBC
SHA-256:	8D3A52171212519B2459AB5A56B2E04330CFEC550571AB51A2A9DB2F4975B8F0
SHA-512:	A9983F0929E0FD34107E8406C77D59F1072171DE6353B7370CF7FAC906BD9D22E7853DE2E717AB527C5A588EBF828600A44C8F26E1D1633654B2EF7E733AB5C9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-14) {. {-9223372036854775808 50400 0 GMT-14}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-2

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.8806789758150835
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDInHkXGm2OHT5L:SlSWB9X5yRUnLm2OHTF
MD5:	6E003424A5856BDD89100B67E854054B
SHA1:	36BBD5B2FB4D24B75B1A753411F7004C86E47988
SHA-256:	3CC173305E900882AF55E03D6D4C3E47F16724EBC8AB36447E77B0A6EB4709F6
SHA-512:	EFCB0EDE5B5F133BD1202EEEA2541AD7103212CAE4B54C7BC558CACD4EBA0F05C1E5D9A21B4AFE87C60B67A2B99CC47817B23CA51A79DA6C467C0FC69ED3ED64
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-2) {. {-9223372036854775808 7200 0 GMT-2}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-3

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.910553245785435
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIYdSXGm2OHkNHYK:SlSWB9X5yRUGJm2OHkVYK
MD5:	2F7E111B51043BCFA1651BE8A651998E
SHA1:	C245D8CCC478F5ADE283AF188183B6E3FF758AD6
SHA-256:	91682AC5E7E42E704CDAB61A53AD9032BA4D76B20AB7E0E9D1FF6E257D0A4AEF
SHA-512:	A7E71F71570A0FFD78AE93FA6CF4E4FCC1C2BB5CB84FEDB2025D4530194727A2B638705DFA3EDC462542853BBE37150CF3321341443B046402F4BCA75D76BDAC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-3) {. {-9223372036854775808 10800 0 GMT-3}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-4

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.931706869905462
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIbSXGm2OHkVAYK:SlSWB9X5yRUtm2OHkG
MD5:	2997FC8D786B69801D79A4085F4423CF
SHA1:	51F53D08EE13D7EC3929ACCA6C6C73DFF97D235D
SHA-256:	6B27BB9C64F458029B7EF637E4FA693503FA0616B47AC950019E5B2EA9FD58F6
SHA-512:	24A387699668B15F8BAB763ED4FF3B183BA12A4F7C0A45BCA441D29A2E51EEE5E4DF094BC1D8A000A9A6D074623DF70D32295935156A837609F923CF88978C9C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-4) {. {-9223372036854775808 14400 0 GMT-4}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-5

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.918117431380773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDI7wkXGm2OHMY+L:SlSWB9X5yRU7Em2OHL+L
MD5:	AEC4F036D40B91B988C45A057BA600F0
SHA1:	00557AEB9DD68ED32502B9A37E10672569784FB8
SHA-256:	AAC87EC45FC1F1D9ABAB05D63E231E5D03BAB056A7129613821875A143B6E8E5
SHA-512:	6C80F3E3F6C3A0D11D18086A170D106B8CCBBAF1EE7AB3AB77DD5DBDC552A9F0E7214D8CC9E263E2A64BC737A33ED6B0F9E68DF7AA11B5460DE2B43508C6F99F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-5) {. {-9223372036854775808 18000 0 GMT-5}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-6

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.934932781202809
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIgwcXGm2OHETN4CC:SlSWB9X5yRUgwTm2OHETrC
MD5:	276357C424E7F0795264A74B92C8D0D4
SHA1:	8115F185ED0FDA154901BC90BDD5B35876A900D9
SHA-256:	4EAAA309869694E52C6F3E5B6C4EC6F019E69388CCC39441263CD300DD0F132E
SHA-512:	11EC84E68A4D2412D141447C22AA3EED7D3D0051DBDC03E5C5E60953BF46D5EFF93C364D8979D7D96F4D701FDCFC28161BCE1D8D3423A5BE7B83CFC99EC80EFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-6) {. {-9223372036854775808 21600 0 GMT-6}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-7

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.888744454221628
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIu/kXGm2OHAX48YK:SlSWB9X5yRUuTm2OHAX48YK
MD5:	FFE4D1EBB7E36990DDD5AAFA9B1B1BAA
SHA1:	DE24C51FADC33087338A93CF8724C53EFBEA76B6
SHA-256:	97D07246E8E875734EC4EFE1C975FB6B5A2436508156BEF0E9FF183FCFC3F8F8
SHA-512:	6788643F0ACD46A922FE5DB0447CD2930D9EE0687FADCB5CF75E91C96AA6AE386BEDCBD659EAA04130BF75B26A7F7CEFFC1AFFE0F3449BA92F07BF6D21C9CA0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-7) {. {-9223372036854775808 25200 0 GMT-7}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-8

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.8739009497670605
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIlEXGm2OHN/VMYvYvn:SlSWB9X5yRUlLm2OHpYvn
MD5:	50F5BFB7971B66F82692411605CA5888
SHA1:	1847C440B0080FD77DA078A2DE0E28EE97D4A610
SHA-256:	A1C2782893170D90770A3969FF22E294AFCEBF29B8EC44B32419CFA3BB7E9046
SHA-512:	A109EE097735AB90BECA833C4C548A2DEAA8A5B2878320773D09D206BF4548BB57BE218D7D853BB69B6B4534FD7F1B0E75BBA8AF501DDAD154F8C934A688AA2A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-8) {. {-9223372036854775808 28800 0 GMT-8}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT-9

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.9172336661585625
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIedSXGm2OHEN3bvn:SlSWB9X5yRUwJm2OHs3Ln
MD5:	34B808BBFF44F16D48AB426A0D465655
SHA1:	A586DE2CA38F1E1B8F7B71ABF87E6D2BB9AAA497
SHA-256:	555BA61552CF78C03475A01E849872317480C8EEEC7F2612546768DE75999E60
SHA-512:	D729DB25769DBE97C6F0E7B10551B8AE29A26D95EC2670D5932C33AF40C45865CC4DCFE81D679F857EBC2973DC02CF045F749D2AB99D31C00865B41375CD2347
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-9) {. {-9223372036854775808 32400 0 GMT-9}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\GMT0

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.836974611939794
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDVMFHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRC1p8RQvn
MD5:	BE8C5C3B3DACB97FADEB5444976AF56A
SHA1:	A0464B66E70A1AF7963D2BE7BC1D88E5842EC99A
SHA-256:	89F4624DC69DE64B7AF9339FE17136A88A0C28F5F300575540F8953B4A621451
SHA-512:	A0E11D9DF5AD2C14A012E82F24298921780E091EEDD680535658F9CD1337A4103BA0676DF9B58865DD7D2CFA96AEED7BF786B88786FAF31B06713D61B4C0308A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT0) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\Etc\Greenwich

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.862741414606617
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRp+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtyRp6BURQvn
MD5:	2DADDAD47A64889162132E8DA0FFF54F
SHA1:	EC213743939D699A4EE4846E582B236F8C18CB29
SHA-256:	937970A93C2EB2D73684B644E671ACA5698BCB228810CC9CF15058D555347F43
SHA-512:	CA8C45BA5C1AF2F9C33D6E35913CED14B43A7AA37300928F14DEF8CB5E7D56B58968B9EE219A0ACCB4C17C52F0FBD80BD1018EF5426C137628429C7DAA41ACA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/Greenwich) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\Etc\UCT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.857741203314798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yR5FkXGm2OHv1CCn:SlSWB9X5yRHm2OHNLn
MD5:	415F102602AFB6F9E9F2B58849A32CC9
SHA1:	002C7D99EBAA57E8599090CFBF39B8BEAABE4635
SHA-256:	549D4CC4336D35143A55A09C96FB9A36227F812CA070B2468BD3BB6BB4F1E58F
SHA-512:	6CA28E71F941D714F3AACA619D0F4FEEF5C35514E05953807C225DF976648F257D835B59A03991D009F738C6FD94EB50B4ECA45A011E63AFDCA537FBAC2B6D1B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UCT) {. {-9223372036854775808 0 0 UCT}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\UTC

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.857741203314798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRF3dFkXGm2OHvr:SlSWB9X5yR9dJm2OHj
MD5:	6343442DDDC19AF39CADD82AC1DDA9BD
SHA1:	9D20B726C012F14D99E701A69C60F81CB33E9DA6
SHA-256:	48B88EED5EF95011F41F5CA7DF48B6C71BED711B079E1132B2C1CD538947EF64
SHA-512:	4CFED8C80D9BC2A75D4659A14F22A507CF55D3DCC88318025BCB8C99AE7909CAF1F11B1ADC363EF007520BF09473CB68357644E41A9BBDAF9DB0B0A44ECC4FBF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UTC) {. {-9223372036854775808 0 0 UTC}.}.

C:\ProgramData\assignee\tcl\tzdata\Etc\Universal

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.825049978035721
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRYzXDJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLyRY7VMr8RI
MD5:	7BE0766999E671DDD5033A61A8D84683
SHA1:	D2D3101E78919EB5FE324FFC85503A25CFD725E0
SHA-256:	90B776CF712B8FE4EEC587410C69A0EC27417E79006132A20288A9E3AC5BE896
SHA-512:	A4CA58CD4DC09393BBE3C43D0B5E851DEBEEDC0C5CEC7DCED4D24C14796FD336D5607B33296985BD14E7660DCE5C85C0FB625B2F1AD9AC10F1631A76ECEB04B8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Universal) $TZData(:Etc/UTC).

C:\ProgramData\assignee\tcl\tzdata\Etc\Zulu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.824450775594084
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRaQEBURFu:SlSWB9IZaM3yzUFVAIgBLyRYaRI
MD5:	64ED445C4272D11C85BD2CFC695F180F
SHA1:	EDE76B52D3EEBCC75C50E17C053009A453D60D42
SHA-256:	A68D32DA2214B81D1C0C318A5C77975DE7C4E184CB4D60F07858920B11D065FE
SHA-512:	4CE8FC2B7C389BD2058CE77CD7234D4EA3F81F40204C9190BF0FB6AA693FB40D0638BFB0EB0D9FA20CB88804B73F6EE8202439C1F553B1293C6D2E5964216A1D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Zulu) $TZData(:Etc/UTC).

C:\ProgramData\assignee\tcl\tzdata\Europe\Amsterdam

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8783
Entropy (8bit):	3.8169718785575446
Encrypted:	false
SSDEEP:	96:nK5UUH6meG6EvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVab:K5VxSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	5CF449C3CF330CE76502C17B6AA67AE9
SHA1:	D91114A1226ADD7FCD643068080791B4D75AA24B
SHA-256:	C47E7F70080911EF797AE3384322E4A4A25AEBB4E9BB98290C03F541ECC67866
SHA-512:	BE32A03279277E0DEC0B4465487872B940384E8B2F6DC8B0FC4D9DD4E33D63F9A83F057A923CFFC6176CB9A9882D366A7AE270C6A01B9975609DFAEC7EA11619
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Amsterdam) {. {-9223372036854775808 1172 0 LMT}. {-4260212372 1172 0 AMT}. {-1693700372 4772 1 NST}. {-1680484772 1172 0 AMT}. {-1663453172 4772 1 NST}. {-1650147572 1172 0 AMT}. {-1633213172 4772 1 NST}. {-1617488372 1172 0 AMT}. {-1601158772 4772 1 NST}. {-1586038772 1172 0 AMT}. {-1569709172 4772 1 NST}. {-1554589172 1172 0 AMT}. {-1538259572 4772 1 NST}. {-1523139572 1172 0 AMT}. {-1507501172 4772 1 NST}. {-1490566772 1172 0 AMT}. {-1470176372 4772 1 NST}. {-1459117172 1172 0 AMT}. {-1443997172 4772 1 NST}. {-1427667572 1172 0 AMT}. {-1406672372 4772 1 NST}. {-1396217972 1172 0 AMT}. {-1376950772 4772 1 NST}. {-1364768372 1172 0 AMT}. {-1345414772 4772 1 NST}. {-1333318772 1172 0 AMT}. {-1313792372 4772 1 NST}. {-1301264372 1172 0 AMT}. {-1282256372 4772 1 NST}. {-1269814772 1172 0 AMT}. {-1250720372 4772 1 NST}. {-123836517

C:\ProgramData\assignee\tcl\tzdata\Europe\Andorra

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6690
Entropy (8bit):	3.730744509734253
Encrypted:	false
SSDEEP:	96:u7rRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:uXRNH4Mn82rlo6XIZ9ALeBO
MD5:	13F10BC59FB9DBA47750CA0B3BFA25E9
SHA1:	992E50F4111D55FEBE3CF8600F0B714E22DD2B16
SHA-256:	E4F684F28AD24B60E21707820C40A99E83431A312D26E6093A198CB344C249DC
SHA-512:	DA5255BDE684BE2C306C6782A61DE38BFCF9CFF5FD117EBDE5EF364A5ED76B5AB88E6F7E08337EEB2CEC9CB03238D9592941BDAA01DFB061F21085D386451AFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Andorra) {. {-9223372036854775808 364 0 LMT}. {-2177453164 0 0 WET}. {-733881600 3600 0 CET}. {481078800 7200 0 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}. {749005200 3600 0 CET}. {764730000 7200 1 CEST}. {780454800 3600 0 CET}. {796179600 7200 1 CEST}. {811904400 3600 0 CET}. {828234000 7200 1 CEST}. {846378000 3600 0 CET}. {859683600 7200 1 CEST}. {877827600 3600 0 CET}. {891133200 7200 1 CEST}. {909277200 3600 0 CET}. {922582800 7200 1 CEST}. {941331600 3600 0 CET}. {9540

C:\ProgramData\assignee\tcl\tzdata\Europe\Athens

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7686
Entropy (8bit):	3.635151038354021
Encrypted:	false
SSDEEP:	96:JAK3+9wAuy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2l:JAKOK1XPzh2kNU4tB715pyzHy1gA
MD5:	D64695F05822EF0DF9E3762A1BC440A0
SHA1:	F17F03CFD908753E28F2C67D2C8649B8E24C35F7
SHA-256:	118289C1754C06024B36AE81FEE96603D182CB3B8D0FE0A7FD16AD34DB81374D
SHA-512:	3C5BDE2004D6499B46D9BAB8DBFDCC1FC2A729EEA4635D8C6CB4279AEE9B5655CE93D2E3F09B3E7295468007FFB5BE6FEC5429501E8FB4D3C2BCC05177C2158A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Athens) {. {-9223372036854775808 5692 0 LMT}. {-2344642492 5692 0 AMT}. {-1686101632 7200 0 EET}. {-1182996000 10800 1 EEST}. {-1178161200 7200 0 EET}. {-906861600 10800 1 EEST}. {-904878000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844477200 7200 1 CEST}. {-828237600 3600 0 CET}. {-812422800 7200 0 EET}. {-552362400 10800 1 EEST}. {-541652400 7200 0 EET}. {166485600 10800 1 EEST}. {186184800 7200 0 EET}. {198028800 10800 1 EEST}. {213753600 7200 0 EET}. {228873600 10800 1 EEST}. {244080000 7200 0 EET}. {260323200 10800 1 EEST}. {275446800 7200 0 EET}. {291798000 10800 1 EEST}. {307407600 7200 0 EET}. {323388000 10800 1 EEST}. {338936400 7200 0 EET}. {347148000 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {4490

C:\ProgramData\assignee\tcl\tzdata\Europe\Belfast

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.827362756219521
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQahs3QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUy70U
MD5:	19134F27463DEDF7E25BC72E031B856F
SHA1:	40D9E60D26C592ED79747D1253A9094FCDE5FD33
SHA-256:	5D31D69F259B5B2DFE016EB1B2B811BD51A1ED93011CBB34D2CF65E4806EB819
SHA-512:	B80202194A9D547AEC3B845D267736D831FB7E720E171265AC3F0074C8B511518952BF686A235E6DDEFC11752C3BD8A48A184930879B68980AC60E9FAECBFB44
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Belfast) $TZData(:Europe/London).

C:\ProgramData\assignee\tcl\tzdata\Europe\Belgrade

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7059
Entropy (8bit):	3.733102701717456
Encrypted:	false
SSDEEP:	96:TX6TRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:TWRNH4Mn82rlo6XIZ9ALeBO
MD5:	841E21EED6229503BF41A858601453B0
SHA1:	6F5632B23F2C710106211FBCD2C17DC40B026BFB
SHA-256:	813B4B4F13401D4F92B0F08FC1540936CCFF91EFD8B8D1A2C5429B23715C2748
SHA-512:	85863B12F17A4F7FAC14DF4D3AB50CE33C7232A519F7F10CC521AC0F695CD645857BD0807F0A9B45C169DD7C1240E026C567B35D1D157EE3DB3C80A57063E8FE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Belgrade) {. {-9223372036854775808 4920 0 LMT}. {-2713915320 3600 0 CET}. {-905824800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-777942000 7200 1 CEST}. {-766623600 3600 0 CET}. {407199600 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CES

C:\ProgramData\assignee\tcl\tzdata\Europe\Berlin

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7746
Entropy (8bit):	3.733442486698092
Encrypted:	false
SSDEEP:	96:hgt67dAtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:hiGRNH4Mn82rlo6XIZ9ALeBO
MD5:	D1E45A4660E00A361729FCD7413361C1
SHA1:	BCC709103D07748E909DD999A954DFF7034F065F
SHA-256:	EAD23E3F58706F79584C1F3F9944A48670F428CACBE9A344A52E19B541AB4F66
SHA-512:	E3A0E6B4FC80A8D0215C81E95F9D3F71C0D9371EE0F6B2B7E966744C42FC64055370D322918EEA2917BFBA07030629C4493ADA257F9BD9C9BF6AD3C4A7FB1E70
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Berlin) {. {-9223372036854775808 3208 0 LMT}. {-2422054408 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-776559600 10800 0 CEMT}. {-765936000 7200 1 CEST}. {-761180400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733273200 3600 0 CET}. {-717631200 7200 1 CEST}. {-714610800 10800 1 CEMT}. {-710380800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET

C:\ProgramData\assignee\tcl\tzdata\Europe\Bratislava

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.89628096026481
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVtXrAevFVAIgoquXrELyQahcvEB5yQazXrY:SlSWB9IZaM3ymzbAevFVAIgozbELy7cY
MD5:	7C0606BC846344D78A85B4C14CE85B95
SHA1:	CEDFDC3C81E519413DDD634477533C89E8AF2E35
SHA-256:	D7DF89C23D2803683FE3DB57BF326846C9B50E8685CCCF4230F24A5F4DC8E44E
SHA-512:	8F07791DE5796B418FFD8945AE13BAB1C9842B8DDC073ED64E12EA8985619B93472C39DD44DA8FAEF5614F4E6B4A9D96E0F52B4ECA11B2CCA9806D2F8DDF2778
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Prague)]} {. LoadTimeZoneFile Europe/Prague.}.set TZData(:Europe/Bratislava) $TZData(:Europe/Prague).

C:\ProgramData\assignee\tcl\tzdata\Europe\Brussels

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8907
Entropy (8bit):	3.75854119398076
Encrypted:	false
SSDEEP:	96:BMlf+jdXtSYv9HMn2vDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHL:BMQSY1RSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	FA802B103E8829C07AE7E05DE7F3CD1F
SHA1:	46AFB26E3E9102F0544C5294DA67DC41E8B2E8FC
SHA-256:	AEB5860C2F041842229353E3F83CC2FEBC9518B115F869128E94A1605FB4A759
SHA-512:	488CE6B524071D2B72F8AD73C2DC00F5F4C1C3C93F91165BDA0BCCB2B2C644B792C4220B785E84835ABE81584FDC87A1DCDA7679A69318052C3854167CB43C61
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Brussels) {. {-9223372036854775808 1050 0 LMT}. {-2840141850 1050 0 BMT}. {-2450953050 0 0 WET}. {-1740355200 3600 0 CET}. {-1693702800 7200 0 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1613826000 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585530000 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301263200 0 0 WET}. {-1284328800 3600 1 WEST}. {-126

C:\ProgramData\assignee\tcl\tzdata\Europe\Bucharest

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7706
Entropy (8bit):	3.6365022673390808
Encrypted:	false
SSDEEP:	96:nQrdI+sYixX215VaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:nQrbEm1Oh2kNU4tB715pyzHy1gA
MD5:	79AAB44507DD6D06FA673CA20D4CF223
SHA1:	A2F1AA0E3F38EF24CD953C6B5E1EC29EA3EDB8C0
SHA-256:	C40DC0C9EE5FFF9F329823325A71F3F38BE940F159E64E0B0CED27B280C1F318
SHA-512:	BBEBB29FFD35A1F8B9D906795032976B3F69A0097ED7D764E3EB45574E66641C35F9006B3295FB090472FF5C09FC4D88D9249E924011A178EFB68D050AA6F871
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Bucharest) {. {-9223372036854775808 6264 0 LMT}. {-2469404664 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {296604000 10800 1 EEST}. {307486800 7200 0 EET}. {323816400 10800 1 EEST}. {338940000 7200 0 EET}. {354672000 10800 0 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200

C:\ProgramData\assignee\tcl\tzdata\Europe\Budapest

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8034
Entropy (8bit):	3.737391538530933
Encrypted:	false
SSDEEP:	96:ZpduEks56myNPcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:ZpMR4RNH4Mn82rlo6XIZ9ALeBO
MD5:	D936EC68FADE43BCF04AB5508A6E01B0
SHA1:	83907E1799DA84006D407118888C0157A8FB3AB8
SHA-256:	B2498F766171DE4DC8F4D9552B116A3A8691177E59D1C6FF6763C1F69B22B672
SHA-512:	7213AA9994CCDC23CD851C91719EAEEB4F2B31C948BC8CC1DD8E8652CE49EF36286984451EC7F7D180082428FDD3693BAFD938D8F13599445C5DA49D2CAD4536
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Budapest) {. {-9223372036854775808 4580 0 LMT}. {-2500938980 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1640998800 3600 0 CET}. {-1633212000 7200 1 CEST}. {-1617577200 3600 0 CET}. {-1600466400 7200 1 CEST}. {-1587250800 3600 0 CET}. {-1569708000 7200 1 CEST}. {-1554332400 3600 0 CET}. {-906937200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-778471200 7200 1 CEST}. {-762487200 3600 0 CET}. {-749689200 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-686185200 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-621990000 7200 1 CEST}. {-605660400 3600

C:\ProgramData\assignee\tcl\tzdata\Europe\Busingen

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.905738881351689
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQahDZALMFB5h8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5Py7D17/8jH
MD5:	811B7E0B0EDD151E52DF369B9017E7C0
SHA1:	3C17D157A626F3AD7859BC0F667E0AB60E821D05
SHA-256:	221C8BA73684ED7D8CD92978ED0A53A930500A2727621CE1ED96333787174E82
SHA-512:	7F980E34BBCBC65BBF04526BF68684B3CE780611090392560569B414978709019D55F69368E98ADADC2C47116818A437D5C83F4E6CD40F4A1674D1CF90307CB5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Busingen) $TZData(:Europe/Zurich).

C:\ProgramData\assignee\tcl\tzdata\Europe\Chisinau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7825
Entropy (8bit):	3.6773421316901067
Encrypted:	false
SSDEEP:	96:J2rdkayurqp4VaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:J2r6Gqpjh2kNU4tB715pyzHy1gA
MD5:	4DD407BF09BEF6999BD16C8426813039
SHA1:	79766397FA1F6986A600C443A8CF4654EB6C3C16
SHA-256:	1F64C2A869CA56DBAAE5AF67B1FACC51BF17ED14D380BC06C252BC07BD9ACFA5
SHA-512:	129D7BFCE88738E5CB9E1EAB0D9EC8FF63329AC712884EE19F11E9C0E55A93F8ACE5C9AD276419F990585FCE4B07A2A1DDF62B54A569CE0170D9A4C85B6F3378
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Chisinau) {. {-9223372036854775808 6920 0 LMT}. {-2840147720 6900 0 CMT}. {-1637114100 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {-927165600 10800 1 EEST}. {-898138800 7200 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-800154000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {4179

C:\ProgramData\assignee\tcl\tzdata\Europe\Copenhagen

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	3.736544358182077
Encrypted:	false
SSDEEP:	96:1Fpd6z8cRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyo:1FpoRNH4Mn82rlo6XIZ9ALeBO
MD5:	8FBF425E5833012C0A6276222721A106
SHA1:	78C5788ED4184A62E0E2986CC0F39EED3801AD76
SHA-256:	D2D091740C425C72C46ADDC23799FC431B699B80D244E4BCD7F42E31C1238EEB
SHA-512:	6DF08142EEBC7AF8A575DD7510B83DBD0E15DDA13801777684355937338CDA3D09E37527912F4EBBCC1B8758E3D65185E6006EB5C1349D1DC3AE7B6131105691
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Copenhagen) {. {-9223372036854775808 3020 0 LMT}. {-2524524620 3020 0 CMT}. {-2398294220 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680490800 3600 0 CET}. {-935110800 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-769388400 3600 0 CET}. {-747010800 7200 1 CEST}. {-736383600 3600 0 CET}. {-715215600 7200 1 CEST}. {-706748400 3600 0 CET}. {-683161200 7200 1 CEST}. {-675298800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528

C:\ProgramData\assignee\tcl\tzdata\Europe\Dublin

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9476
Entropy (8bit):	3.729722634283483
Encrypted:	false
SSDEEP:	192:fIfr5ZO/H8XKKRjuBHI2RLQbTaO5drSf72kVHe:fItZO/Hk5RSBHIB5tSf72kVHe
MD5:	49EA614B5BCB8602EF8D9F365FBBE43D
SHA1:	CF477D1759F428EA4C8A5DF89C5D3E0639422CD6
SHA-256:	F686B3AEA13F71ABB8C864B2574441FF8B6F313D6F88FC502C93B89454CF542F
SHA-512:	B9712380CA101A8FA768D06FA7DFA059DA2886E5BAD8806723CE44ECC06990BE65364498C8A37001FDD67608D2AF668FD1A37C5EDD8D4EA3AB63E338F927ADC5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Dublin) {. {-9223372036854775808 -1500 0 LMT}. {-2821649700 -1521 0 DMT}. {-1691962479 2079 1 IST}. {-1680471279 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1517011200 0 0 IST}. {-1507500000 3600 1 IST}. {-1490565600 0 0 IST}. {-1473631200 3600 1 IST}. {-1460930400 0 0 IST}. {-1442786400 3600 1 IST}. {-1428876000 0 0 IST}. {-1410732000 3600 1 IST}. {-1396216800 0 0 IST}. {-1379282400 3600 1 IST}. {-1364767200 0 0 IST}. {-1348437600 3600 1 IST}. {-1333317600 0 0 IST}. {-1315778400 3600 1 IST}. {-1301263200 0 0 IST}. {-1284328800 3600 1 IST}. {-1269813600 0 0 IST}. {-1253484000 3600 1 IST}. {-1238364000 0 0 IST}. {-

C:\ProgramData\assignee\tcl\tzdata\Europe\Gibraltar

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9181
Entropy (8bit):	3.7982744899840535
Encrypted:	false
SSDEEP:	96:i2elBN44y3UKdDDMjEZtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIV0:i44y1xZGRNH4Mn82rlo6XIZ9ALeBO
MD5:	F8AEFE8F561ED7E1DC81117676F7D0E0
SHA1:	1148176C2766B205B5D459A620D736B1D28283AA
SHA-256:	FB771A01326E1756C4026365BEE44A6B0FEF3876BF5463EFAB7CF4B97BF87CFC
SHA-512:	7C06CB215B920911E0DC9D24F0DD6E24DEC3D75FB2D0F175A9B4329304C9761FFFEE329DD797FF4343B41119397D7772D1D3DFC8F90C1DE205380DE463F42854
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Gibraltar) {. {-9223372036854775808 -1284 0 LMT}. {-2821649916 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}.

C:\ProgramData\assignee\tcl\tzdata\Europe\Guernsey

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.830450830776494
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQakQAL/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyYL5
MD5:	DC2B3CAC4AF70A61D0F4C53288CC8D11
SHA1:	A423E06F88FDEED1960AF3C46A67F1CB9F293CAF
SHA-256:	9CB6E6FEC9461F94897F0310BFC3682A1134E284A56C729E7F4BCE726C2E2380
SHA-512:	8B455DA1D1A7AA1259E6E5A5CF90E62BA8073F769DCB8EB82503F2DFB70AA4539A688DC798880339A2722AA1871E8C8F16D8827064A2D7D8F2F232880359C78D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Guernsey) $TZData(:Europe/London).

C:\ProgramData\assignee\tcl\tzdata\Europe\Helsinki

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7120
Entropy (8bit):	3.6356606479455618
Encrypted:	false
SSDEEP:	96:Uw3XHk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ9A:UuXPzh2kNU4tB715pyzHy1gA
MD5:	7284918DF76869F24B390D05949EDA2C
SHA1:	4B934B91392BB2C2F71DF8ACBCA2F4918031D413
SHA-256:	89AAD5FE56B54A251D823A5F82593D969D8A586E338547E41CDA5F808A3A8C26
SHA-512:	71A51DA5D26206AC80653E4B16C7C11003EE3ED0A15457D2DA3E829239AE0585CA0A6F231E0BCA4AC3E53B297A7C8827E58455345C76AFD8BA5B5DAEA04E9782
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Helsinki) {. {-9223372036854775808 5992 0 LMT}. {-2890258792 5992 0 HMT}. {-1535938792 7200 0 EET}. {-875671200 10800 1 EEST}. {-859863600 7200 0 EET}. {354672000 10800 1 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {410220000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}. {733280400 10800 1 EEST}. {749005200 7200 0 EET}. {764730000

C:\ProgramData\assignee\tcl\tzdata\Europe\Isle_of_Man

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.866592240835745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQaqpfioxp8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUycqO
MD5:	9E18F66C32ADDDBCEDFE8A8B2135A0AC
SHA1:	9D2DC5BE334B0C6AEA15A98624321D56F57C3CB1
SHA-256:	6A03679D9748F4624078376D1FD05428ACD31E7CABBD31F4E38EBCCCF621C268
SHA-512:	014BAD4EF0209026424BC68CBF3F5D2B22B325D61A4476F1E4F020E1EF9CD4B365213E01C7EC6D9D40FA422FE8FE0FADB1E4CBB7D46905499691A642D813A379
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London).

C:\ProgramData\assignee\tcl\tzdata\Europe\Istanbul

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8735
Entropy (8bit):	3.6454204515361117
Encrypted:	false
SSDEEP:	96:kICNapz9QnPPWDePrDaQrclxXl9k1dgsh6YlvsUM2kNU4tztagAwkY5V778e27zE:kuQnPoOuX1iCrh2kNU4tB715pyzHy1gA
MD5:	7F1FEE8A214FC908267150BC80CE7260
SHA1:	3950CC97A46CC1678BE35509DB67DB9430710EAE
SHA-256:	98130CD8C6A3CCAE4CC730D3F1C3C94BE157091A187D4A4A1AF1A61DE75F1EC4
SHA-512:	589BE4038D548433A6C698640CD25EE6CF3E9BCB0D8F2080A19E00CCE243D52D61A5CCB2F94B1D60B5AD5A3DFF008EEF87F162626D77E49B0934CDC436A91205
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Istanbul) {. {-9223372036854775808 6952 0 LMT}. {-2840147752 7016 0 IMT}. {-1869875816 7200 0 EET}. {-1693706400 10800 1 EEST}. {-1680490800 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1440208800 10800 1 EEST}. {-1428030000 7200 0 EET}. {-1409709600 10800 1 EEST}. {-1396494000 7200 0 EET}. {-931140000 10800 1 EEST}. {-922762800 7200 0 EET}. {-917834400 10800 1 EEST}. {-892436400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857358000 7200 0 EET}. {-781063200 10800 1 EEST}. {-764737200 7200 0 EET}. {-744343200 10800 1 EEST}. {-733806000 7200 0 EET}. {-716436000 10800 1 EEST}. {-701924400 7200 0 EET}. {-684986400 10800 1 EEST}. {-670474800 7200 0 EET}. {-654141600 10800 1 EEST}. {-639025200 7200 0 EET}.

C:\ProgramData\assignee\tcl\tzdata\Europe\Jersey

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.831245786685746
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQap6cEBx/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyzO5
MD5:	F43ABA235B8B98F5C64181ABD1CEEC3A
SHA1:	A4A7D71ED148FBE53C2DF7497A89715EB24E84B7
SHA-256:	8E97798BE473F535816D6D9307B85102C03CC860D3690FE59E0B7EEF94D62D54
SHA-512:	B0E0FC97F08CB656E228353594FC907FC94A998859BB22648BF78043063932D0FC7282D31F63FCB79216218695B5DCDF298C37F0CB206160798CF3CA2C7598E1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Jersey) $TZData(:Europe/London).

C:\ProgramData\assignee\tcl\tzdata\Europe\Kaliningrad

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2369
Entropy (8bit):	3.8767665807730056
Encrypted:	false
SSDEEP:	48:cGv6a621nwJ2JoJrprXnW0UiVV0Qv3LEevBFoBGrjI9q1F008bBJdT:cGvt67yurprXWTeV/DYtX9
MD5:	FBCBB684A231BAB14E004DD9C5BF3EE3
SHA1:	D7CCCAB46E58E5A94069D8A5613C1D1A41153B79
SHA-256:	F5A29C5166E9101D782845772C562239B5B82B0129543E5719A6BB89D9617949
SHA-512:	98B771C03DCAD8DCD3949DE734474C83B073C5CF9283857093BD342D38BDECDD542A7C20B18AEB620CA6B06BBC72CED11DCF2B91B856803F5A6F0728C554CE28
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kaliningrad) {. {-9223372036854775808 4920 0 LMT}. {-2422056120 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 7200 0 CET}. {-778730400 10800 1 CEST}. {-762663600 7200 0 CET}. {-757389600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}

C:\ProgramData\assignee\tcl\tzdata\Europe\Kiev

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7200
Entropy (8bit):	3.672920710705179
Encrypted:	false
SSDEEP:	96:j/fE2JyurxVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ9A:j/fN8G2h2kNU4tB715pyzHy1gA
MD5:	13741DB275EB16C2400E9ED056FFC7A5
SHA1:	35B52592F4ED24F993DF4B44AFD6BD7AA5EDE7B5
SHA-256:	C4753749B948962D1AA74996C5C87EDA44DD6DCD047297013C4D5011CB87DB90
SHA-512:	FBCC3A2CBAAA7549209B92A17EE4E3E105A7A004D948DB48D3C2715A58B7713D58C0AAE75F816CEE0031589A8440457BB13531DDC41199C4D2D766DA55CE8306
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kiev) {. {-9223372036854775808 7324 0 LMT}. {-2840148124 7324 0 KMT}. {-1441159324 7200 0 EET}. {-1247536800 10800 0 MSK}. {-892522800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-825382800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 7200 0 EET}. {694216800 7200 0 EET}. {701820000 10800 1 EEST}. {717541200 7200 0 EET}. {733269600 108

C:\ProgramData\assignee\tcl\tzdata\Europe\Lisbon

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9471
Entropy (8bit):	3.7391980541103296
Encrypted:	false
SSDEEP:	192:kzgVSz+IZHX68PlXIFj544IrvfMsbxZTH7qwQ:kzYSz+IZHX68PlYFUM8xZTH7qwQ
MD5:	9C7AACDBECC1C8034DCD54B22078A805
SHA1:	B733D1E7EC7CBD27656895A3A9C3689280781CE4
SHA-256:	DA4B3330A7A5722C34FDFD765A1AFA9F8955437DF63578AE8B9DACD8A3D6090E
SHA-512:	E1FB6BB3BEF79C945061BB4678E561DAD9B28885A7B846FA5C882339F9C7B5C675E7024EDD34AC83EAE601842A957E11B8E1090EEB34A1CA0A0F8804B6289A3E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Lisbon) {. {-9223372036854775808 -2192 0 LMT}. {-2713908208 -2192 0 LMT}. {-1830381808 0 0 WET}. {-1689555600 3600 1 WEST}. {-1677801600 0 0 WET}. {-1667437200 3600 1 WEST}. {-1647738000 0 0 WET}. {-1635814800 3600 1 WEST}. {-1616202000 0 0 WET}. {-1604365200 3600 1 WEST}. {-1584666000 0 0 WET}. {-1572742800 3600 1 WEST}. {-1553043600 0 0 WET}. {-1541206800 3600 1 WEST}. {-1521507600 0 0 WET}. {-1442451600 3600 1 WEST}. {-1426813200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1221440400 3600 1 WEST}. {-1206925200 0 0 WET}. {-1191200400 3600 1 WEST}. {-1175475600 0 0 WET}. {-1127696400 3600 1 WEST}. {-1111971600 0 0 WET}. {-1096851600 3600 1 WEST}. {-1080522000

C:\ProgramData\assignee\tcl\tzdata\Europe\Ljubljana

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.901869793666386
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQavPSJ5QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqm
MD5:	5F2AEC41DECD9E26955876080C56B247
SHA1:	4FDEC0926933AE5651DE095C519A2C4F9E567691
SHA-256:	88146DA16536CCF587907511FB0EDF40E392E6F6A6EFAB38260D3345CF2832E1
SHA-512:	B71B6C21071DED75B9B36D49EB5A779C5F74817FF070F70FEAB9E3E719E5F1937867547852052AA7BBAE8B842493FBC7DFAFD3AC47B70D36893541419DDB2D74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade).

C:\ProgramData\assignee\tcl\tzdata\Europe\London

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	3.737361476589814
Encrypted:	false
SSDEEP:	192:Gj4y1xZfvm8nKrhFs3XRnRaQqTLJaMt/VZ1R6Y+:GjPxZfvmgEhS3XRmau/VZ1R6Y+
MD5:	2A53A87C26A5D2AF62ECAAD8CECBF0D7
SHA1:	025D31C1D32F1100C1B00858929FD29B4E66E8F6
SHA-256:	2A69A7C9A2EE3057EBDB2615DBE5CB08F5D334210449DC3E42EA88564C29583A
SHA-512:	81EFA13E4AB30A9363E80EC1F464CC51F8DF3C492771494F3624844E074BA9B84FE50EF6C32F9467E6DAB41BD5159B492B752D0C97F3CB2F4B698C04E68C0255
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/London) {. {-9223372036854775808 -75 0 LMT}. {-3852662325 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}. {-120

C:\ProgramData\assignee\tcl\tzdata\Europe\Luxembourg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8826
Entropy (8bit):	3.7634145613638657
Encrypted:	false
SSDEEP:	96:TYt4c9+dcVhv9HMLftvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAr:0w2h1QSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	804A17ED0B32B9751C38110D28EB418B
SHA1:	24235897E163D33970451C48C4260F6C10C56ADD
SHA-256:	00E8152B3E5CD216E4FD8A992250C46E600E2AD773EEDDD87DAD31012BE55693
SHA-512:	53AFDDE8D516CED5C6CF0A906DBF72AF09A62278D1FC4D5C1562BBCE853D322457A6346C3DE8F112FCF665102E19A2E677972E941D0C80D0AB7C8DD0B694628E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Luxembourg) {. {-9223372036854775808 1476 0 LMT}. {-2069713476 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1662343200 7200 1 CEST}. {-1650157200 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1612659600 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585519200 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552258800 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520550000 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490572800 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459119600 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427673600 0 0 WET}. {-1411866000 3600 1 WEST}. {-1396224000 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301270400 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269813600 0 0 WET}. {-1253484000 3600 1 WEST}. {-

C:\ProgramData\assignee\tcl\tzdata\Europe\Madrid

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8282
Entropy (8bit):	3.756812378817409
Encrypted:	false
SSDEEP:	96:kHB87tmDnTNSSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZY:oOMUSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	4BC0D203C28DF6DCB2C9595DFFA3E5C7
SHA1:	0A592FFBD7703AF803BF7EDA96E7BE9A3551A72E
SHA-256:	7F1EC4E7AC29B935823B0155CA07C1FE3092E7202EC0DE3F3CBD8FB9D5E795FB
SHA-512:	B651AF5693A7A8F7816F526AB3AE0548F953AB49125E113F2C906CF9050F4F0ECF9F59F1CBDFC9E5E6F6FB5D46E7E1F9B7A5D2C8D270B7C32063355582393118
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Madrid) {. {-9223372036854775808 -884 0 LMT}. {-2177451916 0 0 WET}. {-1661734800 3600 1 WEST}. {-1648429200 0 0 WET}. {-1631926800 3600 1 WEST}. {-1616893200 0 0 WET}. {-1601254800 3600 1 WEST}. {-1585357200 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427677200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1029114000 3600 1 WEST}. {-1017622800 0 0 WET}. {-1002848400 3600 1 WEST}. {-986173200 0 0 WET}. {-969238800 3600 1 WEST}. {-954118800 0 0 WET}. {-940208400 3600 1 WEST}. {-873079200 7200 1 WEMT}. {-862538400 3600 1 WEST}. {-842839200 7200 1 WEMT}. {-828237600 3600 1 WEST}. {-811389600 7200 1 WEMT}. {-796010400 3600 1 WEST}. {-779940000 7200 1 WEMT}. {-765421200 3

C:\ProgramData\assignee\tcl\tzdata\Europe\Malta

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8425
Entropy (8bit):	3.7277252681393933
Encrypted:	false
SSDEEP:	96:wpTw6hpNqX5vln3mcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0c:wL0JvlJRNH4Mn82rlo6XIZ9ALeBO
MD5:	B6E871EFFA21231DA8D2B45401F09011
SHA1:	4766A6C2B75F3B739E9D0418F56163D529AF9DEF
SHA-256:	9D766E6E252EA2F30811661549B3359A351C42C6558793DCD4919B55A23DE632
SHA-512:	29E146CAAE7E3F289015405809410FA56C52C472812F5579A8907DF4E09292D4ED200E75F13850A8CE740FB4FD840A629FEA7F3398C60E7A8E8D8A317C8C49CA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Malta) {. {-9223372036854775808 3484 0 LMT}. {-2403478684 3600 0 CET}. {-1690851600 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1649034000 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616979600 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585530000 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555290000 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 CEST}. {-71719200 3600 0 CET}. {-50547600 7200 1 CEST}. {-40269600 3600 0 CET}

C:\ProgramData\assignee\tcl\tzdata\Europe\Mariehamn

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.913470013356756
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV1AYKjGyVAIgoq2AYKjvCW6yQausWILMFJ8QarAYKa:SlSWB9IZaM3ymrAdjGyVAIgorAdjoyGK
MD5:	CFB0DE2E11B8AF400537BD0EF493C004
SHA1:	32E8FCB8571575E9DFE09A966F88C7D3EBCD183E
SHA-256:	5F82A28F1FEE42693FD8F3795F8E0D7E8C15BADF1FD9EE4D45794C4C0F36108C
SHA-512:	9E36B2EACA06F84D56D9A9A0A83C7C106D26A6A55CBAA696729F105600F5A0105F193899D5996C416EFAABC4649E91BA0ED90D38E8DF7B305C6D951A31C80718
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Helsinki)]} {. LoadTimeZoneFile Europe/Helsinki.}.set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki).

C:\ProgramData\assignee\tcl\tzdata\Europe\Minsk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2072
Entropy (8bit):	3.850874699236306
Encrypted:	false
SSDEEP:	48:K6ccjMsJ2JoJrZiuRVV0Qv3LEevBFoBGrjI9q1F008bBJdT:PRjMAyurZTV/DYtX9
MD5:	D72EB835D4C93196EAA246F455C56FD3
SHA1:	A6B60504F300D8CE0AB194B1EC25331315EBA6FF
SHA-256:	69DC5909881F2A87E991136BB6B4284FBB1FAB5BAF29845226DD2F1F3AD3EBB6
SHA-512:	34BEADC41FE08143FA1BE4F74B08C03F743C4B306FC23E83FE51142837AF60F9383899636EE40DD96AC1C5A65FDF39BC07AAE4977643058055A41CFC3A36DD25
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Minsk) {. {-9223372036854775808 6616 0 LMT}. {-2840147416 6600 0 MMT}. {-1441158600 7200 0 EET}. {-1247536800 10800 0 MSK}. {-899780400 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-804646800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {670374000 10800 1 EEST}. {686102400 7200 0 EET}. {701820000 10800 1 EEST}. {71754480

C:\ProgramData\assignee\tcl\tzdata\Europe\Monaco

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8871
Entropy (8bit):	3.7700564621466666
Encrypted:	false
SSDEEP:	96:2LCV8tXttpD72RXbvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHT/:eAYt+STRNH4Mn82rlo6XIZ9ALeBO
MD5:	B2BA91B2CDD19E255B68EA35E033C061
SHA1:	246E377E815FFC11BBAF898E952194FBEDAE9AA2
SHA-256:	768E3D45DB560777C8E13ED9237956CFE8630D840683FAD065A2F6948FD797BE
SHA-512:	607383524C478F1CB442679F6DE0964F8916EE1A8B0EF6806BDF7652E4520B0E842A611B432FB190C30C391180EA1867268BBBF6067310F70D5E72CB3E4D789F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Monaco) {. {-9223372036854775808 1772 0 LMT}. {-2486680172 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0

C:\ProgramData\assignee\tcl\tzdata\Europe\Moscow

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2348
Entropy (8bit):	3.8485032810607995
Encrypted:	false
SSDEEP:	24:cYeOngzFgEFFkebUe9clUetph7+UeGH3UeRUeIuUeKqCbUeaJJUevTkUetUeibEX:3ngzJF78xJ2JoJrprXnECL9yLI0vjlR
MD5:	B70F0638493B5690C825335FF9337849
SHA1:	5AA0B03B5559B808B6B4D7CFAA3F5D33C4057182
SHA-256:	89F89C82CCC8CFE0063BC3AB37CADB6F77E8960EFC9355C12FAFA30B451D71AA
SHA-512:	FA466E98640A7D23A770B558D71B77C6F7DC9D638BA4F8AC906C3321B5811061A0F60334E01896491822458B8D10C791F5B17489731EA6CE11BBFD4210AFDE31
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Moscow) {. {-9223372036854775808 9020 0 LMT}. {-2840149820 9000 0 MMT}. {-1688265000 9048 0 MMT}. {-1656819048 12648 1 MST}. {-1641353448 9048 0 MMT}. {-1627965048 16248 1 MDST}. {-1618716648 12648 1 MST}. {-1596429048 16248 1 MDST}. {-1593822648 14400 0 MSD}. {-1589860800 10800 0 MSK}. {-1542427200 14400 1 MSD}. {-1539493200 18000 1 MSD}. {-1525323600 14400 1 MSD}. {-1522728000 10800 0 MSK}. {-1491188400 7200 0 EET}. {-1247536800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800

C:\ProgramData\assignee\tcl\tzdata\Europe\Nicosia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.73570159193188
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85GKLWVAIgNwMGKLG6yQatHefeWFKYGKL1:SlSWB9IZaM3yZdLWVAIgGMdL9y3HefeW
MD5:	47C275C076A278CA8E1FF24E9E46CC22
SHA1:	55992974C353552467C2B57E3955E4DD86BBFAD2
SHA-256:	34B61E78EF15EA98C056C1AC8C6F1FA0AE87BD6BC85C58BE8DA44D017B2CA387
SHA-512:	1F74FC0B452C0BE35360D1C9EC8347063E8480CA37BE893FD4FF7FC2279B7D0C0909A26763C7755DFB19BE9736340D3FB00D39E9F6BF23C1D2F0015372139847
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Nicosia)]} {. LoadTimeZoneFile Asia/Nicosia.}.set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia).

C:\ProgramData\assignee\tcl\tzdata\Europe\Oslo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7651
Entropy (8bit):	3.7309855254369766
Encrypted:	false
SSDEEP:	96:aG6sT+cQJWxdocRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:abcQJWxd/RNH4Mn82rlo6XIZ9ALeBO
MD5:	2A3F771DD9EAE2E9C1D8394C12C0ED71
SHA1:	541DCF144EFFE2DFF27B81A50D245C7385CC0871
SHA-256:	8DDFB0296622E0BFDBEF4D0C2B4EA2522DE26A16D05340DFECA320C0E7B2B1F7
SHA-512:	E1526BD21E379F8B2285481E3E12C1CF775AE43E205D3E7E4A1906B87821D5E15B101B24463A055B6013879CD2777112C7F27B5C5220F280E3C48240367AA663
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Oslo) {. {-9223372036854775808 2580 0 LMT}. {-2366757780 3600 0 CET}. {-1691884800 7200 1 CEST}. {-1680573600 3600 0 CET}. {-927511200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-765327600 3600 0 CET}. {-340844400 7200 1 CEST}. {-324514800 3600 0 CET}. {-308790000 7200 1 CEST}. {-293065200 3600 0 CET}. {-277340400 7200 1 CEST}. {-261615600 3600 0 CET}. {-245890800 7200 1 CEST}. {-230166000 3600 0 CET}. {-214441200 7200 1 CEST}. {-198716400 3600 0 CET}. {-182991600 7200 1 CEST}. {-166662000 3600 0 CET}. {-147913200 7200 1 CEST}. {-135212400 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {40185

C:\ProgramData\assignee\tcl\tzdata\Europe\Paris

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8838
Entropy (8bit):	3.7637328221887567
Encrypted:	false
SSDEEP:	96:1XV8tXttpD724lvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIu:1FYtPSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	153CA0EF3813D91C5E23B34ADFE7A318
SHA1:	F7F18CB34424A9B62172F00374853F1D4A89BEE4
SHA-256:	092BF010A1CF3819B102C2A70340F4D67C87BE2E6A8154716241012B5DFABD88
SHA-512:	E2D418D43D9DFD169238DDB0E790714D3B88D16398FA041A9646CB35F24EF79EE48DA4B6201E6A598E89D4C651F8A2FB9FB874B2010A51B3CD35A86767BAF4D2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Paris) {. {-9223372036854775808 561 0 LMT}. {-2486678901 561 0 PMT}. {-1855958901 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0 W

C:\ProgramData\assignee\tcl\tzdata\Europe\Podgorica

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.86256001696314
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQazKIGl1/yQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq7
MD5:	4F430ECF91032E40457F2D2734887860
SHA1:	D1C099523C34ED0BD48C24A511377B232548591D
SHA-256:	F5AB2E253CA0AB7A9C905B720B19F713469877DE1874D5AF81A8F3E74BA17FC8
SHA-512:	2E6E73076A18F1C6C8E89949899F81F232AE66FEB8FFA2A5CE5447FFF581A0D5E0E88DABEAA3C858CC5544C2AE9C6717E590E846CBFD58CEF3B7558F677334FB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade).

C:\ProgramData\assignee\tcl\tzdata\Europe\Prague

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7684
Entropy (8bit):	3.7339342503071604
Encrypted:	false
SSDEEP:	96:3NtqSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzU:3+STRNH4Mn82rlo6XIZ9ALeBO
MD5:	9CBA0FD603583AED62B969E8CCF0A356
SHA1:	A2EF7D60181976E2225D15DB40F9BCE4FBF82E8D
SHA-256:	B0CE7042D39DE578FDDBCEFE9EAE793C044F036E80AA4F723C9F284F7C32262E
SHA-512:	6CABAAD76ADCD33363E785262AE08C17218FF1A374236A99120AA0F5DF1386B0CC5B08A8BD85E01553E2E543B7647282FEC82F69281C8B1D582F08152DE28506
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Prague) {. {-9223372036854775808 3464 0 LMT}. {-3786829064 3464 0 PMT}. {-2469401864 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-798073200 3600 0 CET}. {-780534000 7200 1 CEST}. {-761180400 3600 0 CET}. {-746578800 7200 1 CEST}. {-733359600 3600 0 CET}. {-716425200 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654217200 7200 1 CEST}. {-639010800 3600 0 CET}. {283993200 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {

C:\ProgramData\assignee\tcl\tzdata\Europe\Riga

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7400
Entropy (8bit):	3.6850163461359067
Encrypted:	false
SSDEEP:	96:hN6YyurGXl6V/jfaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:hGGG160h2kNU4tB715pyzHy1gA
MD5:	310D3FAAC268D48C554CC32C51322696
SHA1:	EA16F8A93AEB1CD34091C1088B16E79F2C8F39B3
SHA-256:	93A2AC0D470B8F7D1DD175C96DC1DEB0925205B6F0C849A7CCAF2F367B683010
SHA-512:	1DA9BFD749FBD4970CDEA6A04E2F382E95505D49AF2026776CA30C43AF72F26DC9E1972CFB86E03D6602896825207B0EA9F8AC012755AB28E777A4A777FB9635
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Riga) {. {-9223372036854775808 5784 0 LMT}. {-2840146584 5784 0 RMT}. {-1632008184 9384 1 LST}. {-1618702584 5784 0 RMT}. {-1601681784 9384 1 LST}. {-1597275384 5784 0 RMT}. {-1377308184 7200 0 EET}. {-928029600 10800 0 MSK}. {-899521200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-795834000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598

C:\ProgramData\assignee\tcl\tzdata\Europe\Rome

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	3.7293906313259404
Encrypted:	false
SSDEEP:	96:YdTwwpNqX5nWycRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:YJ0J2RNH4Mn82rlo6XIZ9ALeBO
MD5:	51C2C963E24C9A4F3C7DB8317B161375
SHA1:	17474F78FDD15A2A56E9F695E2512929BFE6020B
SHA-256:	5A8734DA41676A811DA5B79F3C7888B72FDE08CDE5E5B8367405D137EA5F5BE2
SHA-512:	52BB9CDFD21748B8AEC93FC1D041D6AB06A2D9AEDF2E40832360A5B69C667068961BB6AF7D5B8D201786F2D083E637FF4663E3DE42DF300738B1BEF9E298834D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Rome) {. {-9223372036854775808 2996 0 LMT}. {-3259097396 2996 0 RMT}. {-2403564596 3600 0 CET}. {-1690851600 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1649034000 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616979600 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585530000 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555290000 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-804819600 3600 0 CET}. {-798080400 3600 0 CET}. {-781052400 7200 1 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 CEST}. {-71719200 3600 0 CET

C:\ProgramData\assignee\tcl\tzdata\Europe\Samara

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2155
Entropy (8bit):	3.957566972369467
Encrypted:	false
SSDEEP:	48:Ynh7bcmFnNXjT+UvqBnX0VZb+Jg1ndgwd:4hvlFnNTTNv8X0VZbag1ndJd
MD5:	05F9746650A7BC0357B2698887AE81AB
SHA1:	6979F86B640B49805346F5F07DD9EB1CCE2F7EE8
SHA-256:	D0239F4748ED04F7D1F4FA8E604721CA6B8BEA8A978F8EA39438AC804C5AB545
SHA-512:	2F17C4808D9C24974497F395D47BE467C11D47CC3370DB78E69A9CC4C66416E85A865647FE3411EBBB022840298A7D513FB17E97F1AD5896091E997B0B803C6F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Samara) {. {-9223372036854775808 12036 0 LMT}. {-1593825636 10800 0 SAMT}. {-1247540400 14400 0 SAMT}. {-1102305600 14400 0 KUYMMTT}. {354916800 18000 1 KUYST}. {370724400 14400 0 KUYT}. {386452800 18000 1 KUYST}. {402260400 14400 0 KUYT}. {417988800 18000 1 KUYST}. {433796400 14400 0 KUYT}. {449611200 18000 1 KUYST}. {465343200 14400 0 KUYT}. {481068000 18000 1 KUYST}. {496792800 14400 0 KUYT}. {512517600 18000 1 KUYST}. {528242400 14400 0 KUYT}. {543967200 18000 1 KUYST}. {559692000 14400 0 KUYT}. {575416800 18000 1 KUYST}. {591141600 14400 0 KUYT}. {606866400 10800 0 KUYMMTT}. {606870000 14400 1 KUYST}. {622594800 10800 0 KUYT}. {638319600 14400 1 KUYST}. {654649200 10800 0 KUYT}. {670374000 7200 0 KUYMMTT}. {670377600 10800 1 KUYST}. {686102400 10800 0 KUYT}. {687916800 14400 0 SAMT}. {701809200 18000 1 SAMST}. {717530400 14400

C:\ProgramData\assignee\tcl\tzdata\Europe\San_Marino

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.908962717024613
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQawELDX7x/yQax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyt/yR
MD5:	C50388AD7194924572FA470761DD09C7
SHA1:	EF0A2223B06BE12EFE55EE72BF2C941B7BFB2FFE
SHA-256:	7F89757BAE3C7AE59200DCEEEE5C38A7F74EBAA4AA949F54AFD5E9BB64B13123
SHA-512:	0CE5FF2F839CD64A2C9A5AE6BBE122C91342AE44BDECDB9A3BA9F08578BC0B474BC0AF0E773868B273423289254909A38902B225A0092D048AC44BCF883AB4B0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/San_Marino) $TZData(:Europe/Rome).

C:\ProgramData\assignee\tcl\tzdata\Europe\Sarajevo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.890934294125181
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawEX3GEaQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqa
MD5:	5C12CEEDB17515260E2E143FB8F867F5
SHA1:	51B9CDF922BFBA52BF2618B63435EC510DEAE423
SHA-256:	7C45DFD5F016982F01589FD2D1BAF97898D5716951A4E08C3540A76E8D56CEB1
SHA-512:	7A6B7FDFD6E5CFEB2D1AC136922304B0A65362E19307E0F1E20DBF48BED95A262FAC9CBCDB015C3C744D57118A85BD47A57636A05144430BF6707404F8E53E8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade).

C:\ProgramData\assignee\tcl\tzdata\Europe\Simferopol

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7265
Entropy (8bit):	3.686901511920866
Encrypted:	false
SSDEEP:	96:jjInyur/gUaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ9A:jj9G4h2kNU4tB715pyzHy1gA
MD5:	C812B3364C36CB38EC093B16D042C5D2
SHA1:	726A9EA1B30FAC44C255824E418D1C4DA2A87A96
SHA-256:	C77998FEF6F9E99CEF3396D5DB9706364D41CF9B486B00A3A1DFC78F977D5390
SHA-512:	C3EE2CF7CD66D261CC9A2F5FC41A2F27221E3412A0FC01C784AA8FA8FB019F1BAD2027311773C6F2AFD4C699BEA522DF1882930F28302B12173D7A82B6D90ABA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Simferopol) {. {-9223372036854775808 8184 0 LMT}. {-2840148984 8160 0 SMT}. {-1441160160 7200 0 EET}. {-1247536800 10800 0 MSK}. {-888894000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-811645200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 7200 0 EET}. {694216800 7200 0 EET}. {701820000 10800 1 EEST}. {71754

C:\ProgramData\assignee\tcl\tzdata\Europe\Skopje

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.906520812033373
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawOgpr8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq3
MD5:	BB062D4D5D6EA9BA172AC0555227A09C
SHA1:	75CCA7F75CEB77BE5AFB02943917DB048051F396
SHA-256:	51820E2C5938CEF89A6ED2114020BD32226EF92102645526352E1CB7995B7D0A
SHA-512:	8C6AD79DD225C566D2D93606575A1BF8DECF091EDFEED1F10CB41C5464A6A9F1C15BEB4957D76BD1E03F5AE430319480A3FDACEF3116EA2AF0464427468BC855
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade).

C:\ProgramData\assignee\tcl\tzdata\Europe\Sofia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7425
Entropy (8bit):	3.636600707094948
Encrypted:	false
SSDEEP:	96:8lAV/6vcB0YixX21/BVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykePG:8lAV/tEm1/mh2kNU4tB715pyzHy1gA
MD5:	CFEFD8E083A3AC248798B514863B2859
SHA1:	B6B0BA60BB1AA91B65A76B7407D89C1C66E0A48A
SHA-256:	A5C1637C550B1F439F48B645C9EEB3B742A55EFAEB32B96838E45B8B9063EDC0
SHA-512:	B03A3D46AE78D7A4C4A03DE1A7DBE708CB2A5858787D30C134C8E9943D2E00C1B202DE1FDBB42E32A01FF4E2DFBDF98ABCF2C2ED870AB492EE76E9D5BE2BD13B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Sofia) {. {-9223372036854775808 5596 0 LMT}. {-2840146396 7016 0 IMT}. {-2369527016 7200 0 EET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-781048800 7200 0 EET}. {291762000 10800 0 EEST}. {307576800 7200 0 EET}. {323816400 10800 1 EEST}. {339026400 7200 0 EET}. {355266000 10800 1 EEST}. {370393200 7200 0 EET}. {386715600 10800 1 EEST}. {401842800 10800 0 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200 10800 1 EEST}. {496800000 7200 0 EET}. {512524800 10800 1 EEST}. {528249600 7200 0 EET}. {543974400 10800 1 EEST}. {559699200 7200 0 EET}. {575424000 10800 1 EEST}. {591148800 7200 0 EET}. {606873600 10800 1 EEST}. {622598400

C:\ProgramData\assignee\tcl\tzdata\Europe\Stockholm

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7058
Entropy (8bit):	3.730067397634837
Encrypted:	false
SSDEEP:	96:K39ucRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:K3HRNH4Mn82rlo6XIZ9ALeBO
MD5:	7F6C45358FC5E91125ACBDD46BBD93FE
SHA1:	C07A80D3C136679751D64866B725CC390D73B750
SHA-256:	119E9F7B1284462EB8E920E7216D1C219B09A73B323796BBF843346ECD71309A
SHA-512:	585AE0B1DE1F5D31E45972169C831D837C19D05E21F65FAD3CB84BEF8270C31BF2F635FB803CB70C569FAC2C8AA6ABDE057943F4B51BF1D73B72695FE95ECFD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Stockholm) {. {-9223372036854775808 4332 0 LMT}. {-2871681132 3614 0 SET}. {-2208992414 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST

C:\ProgramData\assignee\tcl\tzdata\Europe\Tallinn

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7322
Entropy (8bit):	3.676305759985654
Encrypted:	false
SSDEEP:	96:dcqDyurGXl6V/D1aKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:e7GG16+h2kNU4tB715pyzHy1gA
MD5:	1B0408D8BBA72BA7ADB24A76736F2DF4
SHA1:	2560D00A090E1198286400A3E2692978A97BCC06
SHA-256:	C40A6469CFAEA8AE23248A5DDDF2E084A3E97082BD333AEAA18B5B8A2ACE6F5F
SHA-512:	50005B4D3BAB98D553E98E0DFA9534245853C3A212FB9C0A9364B182803DD4245A2A36D61B58BECCAE30B27387811A1A46B96EAF4DF633F6C08214D148FFE483
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tallinn) {. {-9223372036854775808 5940 0 LMT}. {-2840146740 5940 0 TMT}. {-1638322740 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1593824400 5940 0 TMT}. {-1535938740 7200 0 EET}. {-927943200 10800 0 MSK}. {-892954800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-797648400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598400 7200 0 EET}. {638

C:\ProgramData\assignee\tcl\tzdata\Europe\Tirane

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7412
Entropy (8bit):	3.7216700074911437
Encrypted:	false
SSDEEP:	96:6t1WXXRM8DAdRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:6GXh9AdRNH4Mn82rlo6XIZ9ALeBO
MD5:	872AB00046280F53657A47D41FBA5EFE
SHA1:	311BF2342808BD9DC8AB2C2856A1F91F50CFB740
SHA-256:	D02C2CD894AE4D3C2619A4249088A566B02517FA3BF65DEFAF4280C407E5B5B3
SHA-512:	2FF901990FA8D6713D875F90FE611E54B35A2216C380E88D408C4FB5BD06916EE804DC6331C117C3AC643731BEADB5BDEDEA0F963B89FAEDB07CA3FFD0B3A535
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tirane) {. {-9223372036854775808 4760 0 LMT}. {-1767230360 3600 0 CET}. {-932346000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-843519600 3600 0 CET}. {136854000 7200 1 CEST}. {149896800 3600 0 CET}. {168130800 7200 1 CEST}. {181432800 3600 0 CET}. {199839600 7200 1 CEST}. {213141600 3600 0 CET}. {231894000 7200 1 CEST}. {244591200 3600 0 CET}. {263257200 7200 1 CEST}. {276040800 3600 0 CET}. {294706800 7200 1 CEST}. {307490400 3600 0 CET}. {326156400 7200 1 CEST}. {339458400 3600 0 CET}. {357087600 7200 1 CEST}. {370389600 3600 0 CET}. {389142000 7200 1 CEST}. {402444000 3600 0 CET}. {419468400 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {457480800 7200 0 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}.

C:\ProgramData\assignee\tcl\tzdata\Europe\Tiraspol

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.85845283098493
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV+NM/LpVAIgoq9NM/eO6yQa3MPgJM1p8QagNM/cn:SlSWB9IZaM3ymI6NVAIgoI6eFytM4M8g
MD5:	743453106E8CD7AE48A2F575255AF700
SHA1:	7CD6F6DCA61792B4B2CBF6645967B9349ECEACBE
SHA-256:	C28078D4B42223871B7E1EB42EEB4E70EA0FED638288E9FDA5BB5F954D403AFB
SHA-512:	458072C7660BEAFEB9AE5A2D3AEA6DA582574D80193C89F08A57B17033126E28A175F5B6E2990034660CAE3BC1E837F8312BC4AA365F426BD54588D0C5A12EB8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Chisinau)]} {. LoadTimeZoneFile Europe/Chisinau.}.set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau).

C:\ProgramData\assignee\tcl\tzdata\Europe\Uzhgorod

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7287
Entropy (8bit):	3.681086026612126
Encrypted:	false
SSDEEP:	96:DptgbYyurZiVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:Dp4GZNh2kNU4tB715pyzHy1gA
MD5:	E1088083B0D5570AF8FBE54A4C553AFB
SHA1:	A6EC8636A0092737829B873C4879E9D4C1B0A288
SHA-256:	19D87DB3DAB942037935FEC0A9A5E5FE24AFEB1E5F0F1922AF2AF2C2E186621D
SHA-512:	C58AA37111AE29F85C9C3F1E52DB3C9B2E2DCEFBBB9ACA4C61AD9B00AA7F3A436E754D2285774E882614B16D5DB497ED370A06EE1AFC513579E1E5F1475CA160
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Uzhgorod) {. {-9223372036854775808 5352 0 LMT}. {-2500939752 3600 0 CET}. {-946774800 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 1 CEST}. {-794714400 3600 0 CET}. {-773456400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 3600 0 CET}. {670384800 7200 0 EET}. {694216800

C:\ProgramData\assignee\tcl\tzdata\Europe\Vaduz

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6911
Entropy (8bit):	3.723944005853111
Encrypted:	false
SSDEEP:	96:KLmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:K9RNH4Mn82rlo6XIZ9ALeBO
MD5:	A7E09F7B3A057B1D70FC6B016BF03D4B
SHA1:	ACB8A4116FB8BC67556B6F7CADD06EF4705AF0C2
SHA-256:	2234E538FB233FFC376AD68D3CFA5288F2663B303EBA26F1826442E7C3195BD9
SHA-512:	16D611143F5FE97092E07923793F45C8EB29C0D2E036B8646CE0FD31EC89C5B5C28DFCF5FF0A784BABFFD8151FD44FD1E346C8B9B62E938F6A68384F265E2256
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vaduz) {. {-9223372036854775808 2284 0 LMT}. {-2385247084 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}. {749005200 3600 0 CET}. {764730000 7200 1 CEST}. {780454800 3600 0 CET}. {796179600 7200 1 CEST}. {811904400 3600 0 CET}. {828

C:\ProgramData\assignee\tcl\tzdata\Europe\Vatican

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.8663121336740405
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQa1xLM1p8Qax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyvN+a
MD5:	0652C9CF19CCF5C8210330B22F200D47
SHA1:	052121E14825CDF98422CAA2CDD20184F184A446
SHA-256:	3BC0656B5B52E3C3C6B7BC5A53F9228AAFA3EB867982CFD9332B7988687D310B
SHA-512:	1880524DCA926F4BFD1972E53D5FE616DE18E4A29E9796ABEAEE4D7CD10C6FE79C0D731B305BD4DAA6FC3917B286543D622F2291B76DABA231B9B22A784C7475
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/Vatican) $TZData(:Europe/Rome).

C:\ProgramData\assignee\tcl\tzdata\Europe\Vienna

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7659
Entropy (8bit):	3.7322931990772257
Encrypted:	false
SSDEEP:	96:2ntWj6DmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:2tWURNH4Mn82rlo6XIZ9ALeBO
MD5:	E8D0D78179D1E9D738CEEC1D0D4943E5
SHA1:	E0469B86F545FFFA81CE9694C96FE30F33F745DD
SHA-256:	44FF42A100EA0EB448C3C00C375F1A53614B0B5D468ADF46F2E5EAFF44F7A64C
SHA-512:	FACA076F44A64211400910E4A7CAD475DD24745ECCE2FE608DD47B0D5BB9221FF15B9D58A767A90FF8D25E0545C3E50B3E464FF80B1D23E934489420640F5C8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vienna) {. {-9223372036854775808 3921 0 LMT}. {-2422055121 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1577926800 3600 0 CET}. {-1569711600 7200 1 CEST}. {-1555801200 3600 0 CET}. {-938905200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-780188400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {323823600 7200 1 CEST}. {338940000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}.

C:\ProgramData\assignee\tcl\tzdata\Europe\Vilnius

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7203
Entropy (8bit):	3.687252441677403
Encrypted:	false
SSDEEP:	96:/FsyurprhV/DAOLl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:/fGthOh2kNU4tB715pyzHy1gA
MD5:	AD8BCF9986455BE7736DF6329408A3F7
SHA1:	D4464B96568015C908FB84DE9500B7CCB8E31C7E
SHA-256:	C3224B2C8358D95E00C8676DB57CC39216E2C85FA503DDEB6BD7E5E42D40403D
SHA-512:	EC02DF9F51B08DAB1D8BD6768CCF5818C4E0D9C9B65D18BE4F04ED22CC393B3FF5AB39719FE47CFA0AB3992516F9C6BC3ABCB1897284CE85DB063646AAC540EB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vilnius) {. {-9223372036854775808 6076 0 LMT}. {-2840146876 5040 0 WMT}. {-1672536240 5736 0 KMT}. {-1585100136 3600 0 CET}. {-1561251600 7200 0 EET}. {-1553565600 3600 0 CET}. {-928198800 10800 0 MSK}. {-900126000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-802141200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {65464

C:\ProgramData\assignee\tcl\tzdata\Europe\Volgograd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2065
Entropy (8bit):	3.9270291367595784
Encrypted:	false
SSDEEP:	24:cReHiebsmkbnDcXAnblUnvFnlu8tmFebnLR8c9neBNknM/pbnRxEUQJcCU2Y9nVi:KeuHtNqmF/NVBN3zE8Ph0Zc0TJjf
MD5:	85616CEF59B4CF742DE3E8B5A941D403
SHA1:	D2C8335BC988E060AF86303835509059E9BECBF0
SHA-256:	3D833532A41370DE66AF722D5919F928561EEA76271706FDA07F803593112B1E
SHA-512:	010CA477929FB1F747EA0B6ED95B4602ABDEA0C76A390E44F4053D48842BE4DE6F254A632C5E862ABA90719146C9571D693E1949D7BE98379E94FC444BFB4D83
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Volgograd) {. {-9223372036854775808 10660 0 LMT}. {-1577761060 10800 0 TSAT}. {-1411873200 10800 0 STAT}. {-1247540400 14400 0 STAT}. {-256881600 14400 0 VOLMMTT}. {354916800 18000 1 VOLST}. {370724400 14400 0 VOLT}. {386452800 18000 1 VOLST}. {402260400 14400 0 VOLT}. {417988800 18000 1 VOLST}. {433796400 14400 0 VOLT}. {449611200 18000 1 VOLST}. {465343200 14400 0 VOLT}. {481068000 18000 1 VOLST}. {496792800 14400 0 VOLT}. {512517600 18000 1 VOLST}. {528242400 14400 0 VOLT}. {543967200 18000 1 VOLST}. {559692000 14400 0 VOLT}. {575416800 18000 1 VOLST}. {591141600 14400 0 VOLT}. {606866400 10800 0 VOLMMTT}. {606870000 14400 1 VOLST}. {622594800 10800 0 VOLT}. {638319600 14400 1 VOLST}. {654649200 10800 0 VOLT}. {670374000 14400 0 VOLT}. {701820000 14400 0 VOLST}. {717534000 10800 0 VOLT}. {733273200 14400 1 VOLST}. {748998000 108

C:\ProgramData\assignee\tcl\tzdata\Europe\Warsaw

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.731361496484662
Encrypted:	false
SSDEEP:	96:uOZMLerhW4v4Qzh3VEbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0c:uArhW4v4yENH4Mn82rlo6XIZ9ALeBO
MD5:	5F72F26A78BECD6702560DE8C7CCB850
SHA1:	A14E10DCC128B88B3E9C5D2A86DAC7D254CEB123
SHA-256:	054C1CDABAD91C624A4007D7594C30BE96906D5F29B54C292E0B721F8CB03830
SHA-512:	564A575EA2FBDB1D262CF55D55BEFC0BF6EF2081D88DE25712B742F5800D2FBE155EDEF0303F62D497BA0E849174F235D8599E09E1C997789E24FE5583F4B0FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Warsaw) {. {-9223372036854775808 5040 0 LMT}. {-2840145840 5040 0 WMT}. {-1717032240 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618696800 7200 0 EET}. {-1600473600 10800 1 EEST}. {-1587168000 7200 0 EET}. {-931734000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 0 CEST}. {-796608000 3600 0 CET}. {-778726800 7200 1 CEST}. {-762660000 3600 0 CET}. {-748486800 7200 1 CEST}. {-733273200 3600 0 CET}. {-715215600 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-397094400 7200 1 CEST}. {-386812800 3600 0 CET}. {-371088000 7200 1 CEST}. {-355363200 3600 0

C:\ProgramData\assignee\tcl\tzdata\Europe\Zagreb

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.851218990240677
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQa5rXv1/h8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqK
MD5:	445F589A26E47F9D7BDF1A403A96108E
SHA1:	B119D93796DA7C793F9ED8C5BB8BB65C8DDBFC81
SHA-256:	6E3ED84BC34D90950D267230661C2EC3C32BA190BD57DDC255F4BE901678B208
SHA-512:	F45AF9AC0AF800FDCC74DBED1BDFA106A6A58A15308B5B62B4CB6B091FCFD321F156618BE2C157A1A6CAFAAAC399E4C6B590AF7CE7176F757403B55F09842FD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade).

C:\ProgramData\assignee\tcl\tzdata\Europe\Zaporozhye

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7236
Entropy (8bit):	3.6800372625002393
Encrypted:	false
SSDEEP:	96:Tns2yurpr2nVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:TuGt2ch2kNU4tB715pyzHy1gA
MD5:	0D78C425E7E5BCFD79CFAFD5FD6404F4
SHA1:	4DA017F7ABC52852AB5163A332CA53E32E2B0E0D
SHA-256:	1EE7A865040D50848CE87CD6EC54F2A6A1C3D0C3638AAA82542F2AE5E63B51AA
SHA-512:	E77200A87E32332FF5B57A350380531386CAAF6B93F8713F5A5CC27751F14B8C0B10564782B460BE595195C58F98CF049B13AB83568EF74BAA1489ACA9576AFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zaporozhye) {. {-9223372036854775808 8440 0 LMT}. {-2840149240 8400 0 CUT}. {-1441160400 7200 0 EET}. {-1247536800 10800 0 MSK}. {-894769200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-826419600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {654649200 10800 0 MSK}. {670374000 10800 0 EEST}. {686091600 7200 0 EET}. {701820000 10800 1 EEST}. {7175

C:\ProgramData\assignee\tcl\tzdata\Europe\Zurich

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7055
Entropy (8bit):	3.7324111276024556
Encrypted:	false
SSDEEP:	96:ZdtmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:ZlRNH4Mn82rlo6XIZ9ALeBO
MD5:	994344602DB2A669C2E7060D1B3A8AE2
SHA1:	A68435A8B62B16FD8BE16ECFB4122499741DAAB5
SHA-256:	C973A01EA421CC13CC48D72D5A42292D73A931D99B48A364A65485440CB79444
SHA-512:	57B323ED402AF91D10BABF8ACEC3019B78E44B954F1A6C889F6C12CB5685B0C63F5786F3540E7F5E4C8C2434667524100F187861B9F40115469D8BE4A759CF21
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zurich) {. {-9223372036854775808 2048 0 LMT}. {-3827954048 1784 0 BMT}. {-2385246584 3600 0 CET}. {-904435200 7200 1 CEST}. {-891129600 3600 0 CET}. {-872985600 7200 1 CEST}. {-859680000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}.

C:\ProgramData\assignee\tcl\tzdata\GB

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.848987525932415
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6wox6QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUwR1O
MD5:	2639233BCD0119FD601F55F2B6279443
SHA1:	AADF9931DF78F5BC16ED4638947E77AE52E80CA1
SHA-256:	846E203E4B40EA7DC1CB8633BF950A8173D7AA8073C186588CC086BC7C4A2BEE
SHA-512:	8F571F2BBE4C60E240C4EBBB81D410786D1CB8AD0761A99ABB61DDB0811ACC92DCC2F765A7962B5C560B86732286356357D3F408CAC32AC1B2C1F8EAD4AEAEA6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB) $TZData(:Europe/London).

C:\ProgramData\assignee\tcl\tzdata\GB-Eire

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.860435123210029
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6w4b/h8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUw4bx
MD5:	51335479044A047F5597F0F06975B839
SHA1:	234CD9635E61E7D429C70E886FF9C9F707FEAF1F
SHA-256:	FAC3B11B1F4DA9D68CCC193526C4E369E3FAA74F95C8BEE8BB9FAE014ACD5900
SHA-512:	4E37EFDFBAFA5C517BE86195373D083FF4370C5031B35A735E3225E7B17A75899FAFFBDF0C8BCFCBC5DC2D037EE9465AD3ED7C0FA55992027DFD69618DC9918F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB-Eire) $TZData(:Europe/London).

C:\ProgramData\assignee\tcl\tzdata\GMT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.817383285510599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwZ8RDMvn:SlSWB9IZaM3yF4FVAIgJtwZ8RQvn
MD5:	D19DC8277A68AA289A361D28A619E0B0
SHA1:	27F5F30CC2603E1BCB6270AF84E9512DADEEB055
SHA-256:	5B90891127A65F7F3C94B44AA0204BD3F488F21326E098B197FB357C51845B66
SHA-512:	B5DD9C2D55BDB5909A29FD386CF107B83F56CD9B9F979A5D3854B4112B7F8950F4E91FB86AF6556DCF583EE469470810F3F8FB6CCF04FDBD6625A4346D3CD728
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\GMT+0

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.868642878112439
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwe7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtwI8RQvn
MD5:	B5065CD8B1CB665DACDB501797AF5104
SHA1:	0DB4E9AC6E38632302D9689A0A39632C2592F5C7
SHA-256:	6FC1D3C727CD9386A11CAF4983A2FC06A22812FDC7752FBFA7A5252F92BB0E70
SHA-512:	BBA1793CA3BBC768EC441210748098140AE820910036352F5784DD8B2DABA8303BA2E266CB923B500E8F90494D426E8BF115ACD0C000CD0C65896CE7A6AD9D66
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT+0) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\GMT-0

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.8553095447791055
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtw4Hp8RDMvn:SlSWB9IZaM3yF4FVAIgJtw4J8RQvn
MD5:	E71CDE5E33573E78E01F4B7AB19F5728
SHA1:	C296752C449ED90AE20F5AEC3DC1D8F329C2274F
SHA-256:	78C5044C723D21375A1154AE301F29D13698C82B3702042C8B8D1EFF20954078
SHA-512:	6EBB39EF85DA70833F8B6CCD269346DC015743BC049F6F1B385625C5498F4E953A0CEDE76C60314EE671FE0F6EEB56392D62E0128F5B04BC68681F71718FE2BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT-0) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\GMT0

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.843152601955343
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwPHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtwvp8RQvn
MD5:	FE666CDF1E9AA110A7A0AE699A708927
SHA1:	0E7FCDA9B47BC1D5F4E0DFAD8A9E7B73D71DC9E3
SHA-256:	0A883AFE54FAE0ED7D6535BDAB8A767488A491E6F6D3B7813CF76BB32FED4382
SHA-512:	763591A47057D67E47906AD22270D589100A7380B6F9EAA9AFD9D6D1EE254BCB1471FEC43531C4196765B15F2E27AF9AAB5A688D1C88B45FE7EEA67B6371466E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT0) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\Greenwich

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.869510201987464
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwE+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtwE6BURQvn
MD5:	F989F3DB0290B2126DA85D78B74E2061
SHA1:	43A0A1737E1E3EF0501BB65C1E96CE4D0B5635FC
SHA-256:	41A45FCB805DB6054CD1A4C7A5CFBF82668B3B1D0E44A6F54DFB819E4C71F68A
SHA-512:	3EDB8D901E04798B566E6D7D72841C842803AE761BEF3DEF37B8CA481E79915A803F61360FA2F317D7BDCD913AF8F5BB14F404E80CFA4A34E4310055C1DF39F2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Greenwich) $TZData(:Etc/GMT).

C:\ProgramData\assignee\tcl\tzdata\HST

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.860812879108152
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5/Lm/kXGm2OH1V9i:SlSWB9X5jmTm2OH1V8
MD5:	3D99F2C6DADF5EEEA4965A04EB17B1BB
SHA1:	8DF607A911ADF6A9DD67D786FC9198262F580312
SHA-256:	2C83D64139BFB1115DA3F891C26DD53B86436771A30FB4DD7C8164B1C0D5BCDE
SHA-512:	EDA863F3A85268BA7A8606E3DCB4D7C88B0681AD8C4CFA1249A22B184F83BFDE9855DD4E5CFC3A4692220E5BEFBF99ED10E13BD98DBCA37D6F29A10AB660EBE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:HST) {. {-9223372036854775808 -36000 0 HST}.}.

C:\ProgramData\assignee\tcl\tzdata\Hongkong

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.865313867650324
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8LizFVAIgN2qPJL/XF1p4WFKQ1n:SlSWB9IZaM3yWzFVAIgAML//p4wKi
MD5:	D828C0668A439FEB9779589A646793F8
SHA1:	1509415B72E2155725FB09615B3E0276F3A46E87
SHA-256:	CF8BFEC73D36026955FA6F020F42B6360A64ED870A88C575A5AA0CD9756EF51B
SHA-512:	0F864B284E48B993DD13296AF05AEB14EBE26AF32832058C1FC32FCCE78E85925A25D980052834035D37935FAAF1CB0A9579AECBE6ADCDB2791A134D88204EBF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Hong_Kong)]} {. LoadTimeZoneFile Asia/Hong_Kong.}.set TZData(:Hongkong) $TZData(:Asia/Hong_Kong).

C:\ProgramData\assignee\tcl\tzdata\Iceland

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.840758003302018
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqLGsA/8rtdVAIgvMGsA/8rN6+GAKyx/2RQqGsA/8ru:SlSWB9IZaM3yj6dVAIgv1b+XZx+RQj7
MD5:	18DEAAAC045B4F103F2D795E0BA77B00
SHA1:	F3B3FE5029355173CD5BA626E075BA73F3AC1DC6
SHA-256:	9BB28A38329767A22CD073DF34E46D0AA202172A4116FBF008DDF802E60B743B
SHA-512:	18140274318E913F0650D21107B74C07779B832C9906F1A2E98433B96AAEADF70D07044EB420A2132A6833EF7C3887B8927CFD40D272A13E69C74A63904F43C9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Reykjavik)]} {. LoadTimeZoneFile Atlantic/Reykjavik.}.set TZData(:Iceland) $TZData(:Atlantic/Reykjavik).

C:\ProgramData\assignee\tcl\tzdata\Indian\Antananarivo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.781985858446846
Encrypted:	false
SSDEEP:	6:SlSWB9X5+LzM2Em2OHDjke4/tcBXV6vUF5RyGl:MBp5+LzHEmdHVtBXsUF5xl
MD5:	E45AE82A1C2D9AC6B609D41CF43F78B6
SHA1:	409FAAF80C2A4C517DCE1714AC0321749CBD00BC
SHA-256:	26B6A8B074D8AEBB641EFAFB7A3FCCBE013381F878B78B1D565EF9F660C34D1F
SHA-512:	921D9C8E3572777375868CE250AF30FFB9B5F918596086C88F8079DA75A51021B76C202FA9926BFDB2480EF79080B90F80BFE04F9A74C3A9DA0FF7B06BAD2119
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Antananarivo) {. {-9223372036854775808 11404 0 LMT}. {-1846293004 10800 0 EAT}. {-499924800 14400 1 EAST}. {-492062400 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Chagos

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.833020200704589
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9WJxwFFkXGm2OHi/FvvUcfJ7XHWKCNd6VVF9CCn:SlSWB9X5+LxWJxwFJm2OHqFvdcK06/rL
MD5:	831E34470252A198FEF349646F018C77
SHA1:	0BB66A14EF623D44EB0871A90A6A20FAB7192F98
SHA-256:	F048C281963B76744560CB1DB5BC5EE9187B858C5280CD952B941E15824820B1
SHA-512:	51D1417B5247A3A95FC2D9B66FD9866625FBB164156B75C4F8B70C752FBF1D56D4824C5471445D16B3280626F05946E741CE735056F7EA51F6E87A57B80BB24C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Chagos) {. {-9223372036854775808 17380 0 LMT}. {-1988167780 18000 0 IOT}. {820436400 21600 0 IOT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Christmas

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.930199400393538
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9FBIEW3v/kXGm2OHAWMx5vXTLyvkUKn:SlSWB9X5+LxpW3vTm2OHAnx5PTIkn
MD5:	735E2827E4C8892ADF7AEF4E64CD65F4
SHA1:	FE96BC6C736EEF734E72751E8D3DC6A7EEE1995D
SHA-256:	21BC09EDE63865AA8F119420E03CF93694C2C6B1BD6061C780D342492352D5D8
SHA-512:	49C491C8AB58A2C71DDE9C87B649A88F5A029694C6BAB556AC93502E0D619F4B7B2452CDC3F555CC417B9B034AE7507E03A863667E2CBDF60BF2C09754966FD8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Christmas) {. {-9223372036854775808 25372 0 LMT}. {-2364102172 25200 0 CXT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Cocos

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.817125950664342
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9d/FkXGm2OHGXTvxoevXmVUXxXW5drv:SlSWB9X5+LxpJm2OHGXCeP3BG51
MD5:	BA772BD604AA20E20DEDB92CC0897CD0
SHA1:	9F088DE7AC470D50EEDB70C1C0A16EBADEE0A87C
SHA-256:	F8FBAC3C0F2E587D2D57DA022DDAC1C9D9C52FFBBD5A7394EB430C4D255BEF3D
SHA-512:	A9D98C4177267DA342AF54C14EEF41671AA2A40673AD3B327A3EEB0AFE6713E3AC4688563F4BA8A677D7373F89A896EA9BF30703148942071F99F349362C571D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Cocos) {. {-9223372036854775808 23260 0 LMT}. {-2209012060 23400 0 CCT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Comoro

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.947849390553444
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9TKlevcXGm2OHrVvUdeUcTmvlv:SlSWB9X5+LxGELm2OHRDw
MD5:	90443386D53CED0ADA74C06F26B03D71
SHA1:	E67C385B2D1FA8F86A50E9A11337C6A05CBA9835
SHA-256:	2FA0BF970C9E2635817D0BD3FD63E15CA1F020EB2AC7E08D8FD9B75368C3915C
SHA-512:	22AED737A80B6171CB91A0A836DA2E4A9884C274632D52078980BCAAA1EC822D6185F4A163779EBC3A4BCDFB0DB9633F9B674D243E1854B126C80DCDA735A3D0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Comoro) {. {-9223372036854775808 10384 0 LMT}. {-1846291984 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Kerguelen

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.907767002704803
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL12hJFkXGm2OHv/fCF/l9vMLKAvn:SlSWB9X5+L5Mm2OHaT1HAv
MD5:	11313145A089DD79DA011B5C42220102
SHA1:	1D568F72456E4412288CA0AA6B85D0FCED1790CA
SHA-256:	DAC12EB569D9845B61E33B52F708F885530F4548671B4EAB089810FFC5B198EB
SHA-512:	EEF87466F41CB7667B3A75D96816BB8E08D12F214F07117125161A62E98CFC377CB116FD5D1A227AC7F9E8BE0DF56C78F20610DEF049B59AC3D67845EE687A80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Kerguelen) {. {-9223372036854775808 0 0 zzz}. {-631152000 18000 0 TFT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Mahe

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.89724791479221
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzJMyFkXGm2OHuVdF+YvXTW1U9VxYKn:SlSWB9X5+L/TJm2OHWgYPhfLn
MD5:	452D5BCD8510F07F85F4D1BA259ACB37
SHA1:	5BE9FD3CB2E2733C3896F44493A7F0A3FFF87573
SHA-256:	00556BBEE6555467802B08E50310B03791B503D5222D115BD45E33AEC09C21E4
SHA-512:	ABA1C01400BCCEFDA856AE42773915983973E5C34210D4854F5B3BE509B0FEF66F73C7D234AFF69DD36B10BA5B57A23B0A78D9138961407B3F8B3E3A04088D3D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mahe) {. {-9223372036854775808 13308 0 LMT}. {-2006653308 14400 0 SCT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Maldives

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.844865929026798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzEyFkXGm2OHnz8evXZT5lxGYUQwGNSavYv:SlSWB9X5+L/EyJm2OHnz8ePZT5rG5QwB
MD5:	8494F3ECF3431E54D340E58B23C1CA70
SHA1:	1D66CB3A04E36DE5954743AE75D278BF627FFCAE
SHA-256:	6E6DD01A3677146DCB426019369F7D535EB7C2FBE7ACCB3BD68987C94C1999AA
SHA-512:	5DD24B5BCCC798CF8AF50CF80CE1AE2F68DA141C4C754EFF4137A726576A7794D1A68804214940156CB71DFED0126B02CFBBEDF3C8C12D396C87B14345198C62
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Maldives) {. {-9223372036854775808 17640 0 LMT}. {-2840158440 17640 0 MMT}. {-315636840 18000 0 MVT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Mauritius

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.577756094679277
Encrypted:	false
SSDEEP:	6:SlSWB9X5+L/Hm2OHlNndSvulvLLc0F8VhvLwBjvVFFGlvLL:MBp5+L/HmdHlNnS6M0FEZEBjVFFG9f
MD5:	C4979F6B63BC9FC82FE470CB790D42BE
SHA1:	E32B16C3914849846FB3A60A4291FC4B1BB6DC5F
SHA-256:	3EBD40E36A9314DC5B3A28FB4FFC2FD5653A33B9CC0E389E112A8A93A8FA8A11
SHA-512:	67B671A9A91EF669854F211567252CFA7158A1FEB42BD8FEB386469844E610AA51DC4CECC561FE2426660B04C30CC477CF2B45FBE7AFA56F7137B25F01447FA9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mauritius) {. {-9223372036854775808 13800 0 LMT}. {-1988164200 14400 0 MUT}. {403041600 18000 1 MUST}. {417034800 14400 0 MUT}. {1224972000 18000 1 MUST}. {1238274000 14400 0 MUT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Mayotte

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.922543186493824
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzOyFkXGm2OHhhvvUdeXvFvlv:SlSWB9X5+L/OyJm2OHPZvr
MD5:	36A2CB5591BF2F4D35DAAB682EAB2376
SHA1:	3D96D1485F355CB163A3AC75D9DFF61D478F26EA
SHA-256:	74B4EF0D5CC060D9050E9A565DB45159D59FFD5ED40B9E3BFDC5AF15860F6FE2
SHA-512:	0E0CC5CD2905D9CDD4D76B3C8B92F2344B9582ADC54B6A6B0CA0F4C6024BD705BC30FA4E1362B5252648D47A3F2592D16AEE550509DFFC91D61965340DD57C95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mayotte) {. {-9223372036854775808 10856 0 LMT}. {-1846292456 10800 0 EAT}.}.

C:\ProgramData\assignee\tcl\tzdata\Indian\Reunion

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.954140296439627
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELsActFkXGm2OHuU7oevUdvcUeNVrCn:SlSWB9X5+Lam2OHb7oezfNAn
MD5:	FD5FB6F6171C8B1FE4B4496E8CCA6C3E
SHA1:	D211CFFF40B2A66C4C6080699D99A69C7040FD90
SHA-256:	A0E47E1C5D4EAEAC532BD9828E74139FB85E7D6B86046BF475E33C2B84C3542F
SHA-512:	C6DF69022CC6C777BF9A7139D1FD8FC892B6DE3065B8923C1D8A9ED9E9E20ACCCE81D4EF61CDDD65FD6B972630A6F64FE6A603975655ED8A8C9B6D27410D4FCD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Reunion) {. {-9223372036854775808 13312 0 LMT}. {-1848886912 14400 0 RET}.}.

C:\ProgramData\assignee\tcl\tzdata\Iran

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.757854680369306
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8g5YFevFVAIgNqjNAt+XiMr4WFKBun:SlSWB9IZaM3yA5owFVAIgcjSt+Xvr4wh
MD5:	848663FD5F685FE1E14C655A0ABA7D6A
SHA1:	59A1BEE5B3BE01FB9D2C73777B7B4F1615DCE034
SHA-256:	DB6D0019D3B0132EF8B8693B1AB2B325D77DE3DD371B1AFDAE4904BE610BA2A6
SHA-512:	B1F8C08AF68C919DB332E6063647AF15CB9FED4046C16BEF9A58203044E36A0D1E69BD1B8703B15003B929409A8D83238B5AA67B910B920F0674C8A0EB5CF125
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tehran)]} {. LoadTimeZoneFile Asia/Tehran.}.set TZData(:Iran) $TZData(:Asia/Tehran).

C:\ProgramData\assignee\tcl\tzdata\Israel

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.778464205793726
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt+WXnMr4WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb+zr4wKY7
MD5:	B9D1F6BD0B0416791036C0E3402C8438
SHA1:	E1A7471062C181B359C06804420091966B809957
SHA-256:	E6EC28F69447C3D3DB2CB68A51EDCEF0F77FF4B563F7B65C9C71FF82771AA3E1
SHA-512:	A5981FD91F6A9A84F44A6C9A3CF247F9BE3AB52CE5FE8EE1A7BE19DD63D0B22818BC15287FE73A5EEC8BCE6022B9EAF54A10AA719ADF31114E188F31EA273E92
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Israel) $TZData(:Asia/Jerusalem).

C:\ProgramData\assignee\tcl\tzdata\Jamaica

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.668645988954937
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx00EIECpVAIg200EIEvvt9S//2IAcGE0EIEVn:SlSWB9IZaM3y7952VAIgp95vF029095V
MD5:	EA38E93941E21CB08AA49A023DCC06FB
SHA1:	1AD77CAC25DC6D1D04320FF2621DD8E7D227ECBF
SHA-256:	21908F008F08C55FB48F1C3D1A1B2016BDB10ED375060329451DE4E487CF0E5F
SHA-512:	D6F0684A757AD42B8010B80B4BE6542ADE96D140EC486B4B768E167502C776B8D289622FBC48BD19EB3D0B3BC4156715D5CCFC7952A479A990B07935B15D26DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Jamaica)]} {. LoadTimeZoneFile America/Jamaica.}.set TZData(:Jamaica) $TZData(:America/Jamaica).

C:\ProgramData\assignee\tcl\tzdata\Japan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.791469556628492
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8aowVAIgNqaF9hM7/4WFK6n:SlSWB9IZaM3ypwVAIgcaF4r4wK6n
MD5:	338A18DEDF5A813466644B2AAE1A7CF5
SHA1:	BB76CE671853780F4971D2E173AE71E82EA24690
SHA-256:	535AF1A79CD01735C5D6FC6DB08C5B0EAFB8CF0BC89F7E943CF419CFA745CA26
SHA-512:	4D44CC28D2D0634200FEA0537EBC5DD50E639365B89413C6BF911DC2B95B78E27F1B92733FB859C794A8C027EA89E45E8C2D6E1504FF315AF68DB02526226AD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tokyo)]} {. LoadTimeZoneFile Asia/Tokyo.}.set TZData(:Japan) $TZData(:Asia/Tokyo).

C:\ProgramData\assignee\tcl\tzdata\Kwajalein

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.759848173726549
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG1/EOM2wFVAIgObT1/EOM8O68/FMKpUDH1/EOMi:SlSWB9IZaM3yc1EiwFVAIgOb1E48xME+
MD5:	A9C8CA410CA3BD4345BF6EAB53FAB97A
SHA1:	57AE7E6D3ED855B1FBF6ABF2C9846DFA9B3FFF47
SHA-256:	A63A99F0E92F474C4AA99293C4F4182336520597A86FCDD91DAE8B25AFC30B98
SHA-512:	C97CF1301DCEEE4DE26BCEEB60545BB70C083CD2D13ED89F868C7856B3532473421599ED9E7B166EA53A9CF44A03245192223D47BC1104CEBD1BF0AC6BF10898
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Kwajalein)]} {. LoadTimeZoneFile Pacific/Kwajalein.}.set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein).

C:\ProgramData\assignee\tcl\tzdata\Libya

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.779409803819657
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsbKJqYkdVAIgNGEnKJuYvW67beDcbKJ9n:SlSWB9IZaM3y7JdVAIgNTnYvW6PeD9n
MD5:	C4739F7B58073CC7C72EF2D261C05C5E
SHA1:	12FE559CA2FEA3F8A6610B1D4F43E299C9FB7BA5
SHA-256:	28A94D9F1A60980F8026409A65F381EDB7E5926A79D07562D28199B6B63AF9B4
SHA-512:	B2DC5CB1AD7B6941F498FF3D5BD6538CAF0ED19A2908DE645190A5C5F40AF5B34752AE8A83E6C50D370EA619BA969C9AB7F797F171192200CDA1657FFFB7F05A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Tripoli)]} {. LoadTimeZoneFile Africa/Tripoli.}.set TZData(:Libya) $TZData(:Africa/Tripoli).

C:\ProgramData\assignee\tcl\tzdata\MET

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	3.7115445412724797
Encrypted:	false
SSDEEP:	96:TJOwNDgaXSgm7VTslzZBYxWq9beN6db6yq3BgLjx1uuE0KRPGdNjClOQuonZ2ltb:bSV7xxWq9aYdbsC/eLdGLg9a
MD5:	2F62D867C8605730BC8E43D300040D54
SHA1:	06AD982DF03C7309AF01477749BAB9F7ED8935A7
SHA-256:	D6C70E46A68B82FFC7A4D96FDA925B0FAAF973CB5D3404A55DFF2464C3009173
SHA-512:	0D26D622511635337E5C03D82435A9B4A9BCA9530F940A70A24AE67EA4794429A5D68B59197B978818BEF0799C3D5FA792F5720965291661ED067570BC56226B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MET) {. {-9223372036854775808 3600 0 MET}. {-1693706400 7200 1 MEST}. {-1680483600 3600 0 MET}. {-1663455600 7200 1 MEST}. {-1650150000 3600 0 MET}. {-1632006000 7200 1 MEST}. {-1618700400 3600 0 MET}. {-938905200 7200 1 MEST}. {-857257200 3600 0 MET}. {-844556400 7200 1 MEST}. {-828226800 3600 0 MET}. {-812502000 7200 1 MEST}. {-796777200 3600 0 MET}. {-781052400 7200 1 MEST}. {-766623600 3600 0 MET}. {228877200 7200 1 MEST}. {243997200 3600 0 MET}. {260326800 7200 1 MEST}. {276051600 3600 0 MET}. {291776400 7200 1 MEST}. {307501200 3600 0 MET}. {323830800 7200 1 MEST}. {338950800 3600 0 MET}. {354675600 7200 1 MEST}. {370400400 3600 0 MET}. {386125200 7200 1 MEST}. {401850000 3600 0 MET}. {417574800 7200 1 MEST}. {433299600 3600 0 MET}. {449024400 7200 1 MEST}. {465354000 3600 0 MET}. {481078800 7200 1 MEST}. {496803600 3600 0 MET

C:\ProgramData\assignee\tcl\tzdata\MST

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.856431808856169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx56xwkXGm2OHrXV4fvYv:SlSWB9X562m2OHrCi
MD5:	FF6BDAC2C77D8287B46E966480BFEACC
SHA1:	4C90F910C74E5262A27CC65C3433D34B5D885243
SHA-256:	FB6D9702FC9FB82779B4DA97592546043C2B7D068F187D0F79E23CB5FE76B5C2
SHA-512:	CA197B25B36DD47D86618A4D39BFFB91FEF939BC02EEB96679D7EA88E5D38737D3FE6BD4FD9D16C31CA5CF77D17DC31E5333F4E28AB777A165050EA5A4D106BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MST) {. {-9223372036854775808 -25200 0 MST}.}.

C:\ProgramData\assignee\tcl\tzdata\MST7MDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.755606924782105
Encrypted:	false
SSDEEP:	96:xG5c2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:12dVUC2mWBNwWTxyWR
MD5:	2AB5643D8EF9FD9687A5C67AEB04AF98
SHA1:	2E8F1DE5C8113C530E5E6C10064DEA4AE949AAE6
SHA-256:	97028B43406B08939408CB1DD0A0C63C76C9A352AEA5F400CE6D4B8D3C68F500
SHA-512:	72A8863192E14A4BD2E05C508F8B376DD75BB4A3625058A97BBB33F7200B2012D92D445982679E0B7D11C978B80F7128B3A79B77938CEF6315AA6C4B1E0AC09C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MST7MDT) {. {-9223372036854775808 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MST}. {262774800 -21600 1 MDT}. {278496000 -252

C:\ProgramData\assignee\tcl\tzdata\Mexico\BajaNorte

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.836487818373659
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo6AdMSKBbh4IAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo68K5h490eu
MD5:	C3AEEA7B991B609A1CB253FDD5057D11
SHA1:	0212056C2A20DD899FA4A26B10C261AB19D20AA4
SHA-256:	599F79242382ED466925F61DD6CE59192628C7EAA0C5406D3AA98EC8A5162824
SHA-512:	38094FD29B1C31FC9D894B8F38909DD9ED3A76B2A27F6BC250ACD7C1EFF4529CD0B29B66CA7CCBEB0146DFF3FF0AC4AEEEC422F7A93422EF70BF723D12440A93
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana).

C:\ProgramData\assignee\tcl\tzdata\Mexico\BajaSur

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.841665860441288
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0zjRJ+vFVAIg20zjRJZvt6AdMPCoQIAcGEzjRJ3:SlSWB9IZaM3y7zjRJQFVAIgpzjRJ1t6n
MD5:	89A5ED35215BA46C76BF2BD5ED620031
SHA1:	26F134644023A2D0DA4C8997C54E36C053AA1060
SHA-256:	D624945E20F30CCB0DB2162AD3129301E5281B8868FBC05ACA3AA8B6FA05A9DF
SHA-512:	C2563867E830F7F882E393080CE16A62A0CDC5841724E0D507CBA362DB8363BB75034986107C2428243680FE930BAC226E11FE6BA99C31E0C1A35D6DD1C14676
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mazatlan)]} {. LoadTimeZoneFile America/Mazatlan.}.set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan).

C:\ProgramData\assignee\tcl\tzdata\Mexico\General

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.8300311016675606
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7zBDdVAIgpzBy6BXl490zBw:MBaIMYzipzU6Bi90zi
MD5:	E771850BA5A1C218EB1B31FDC564DF02
SHA1:	3675838740B837A96FF32694D1FA56DE01DE064F
SHA-256:	06A45F534B35538F32A77703C6523CE947D662D136C5EC105BD6616922AEEB44
SHA-512:	BD7AF307AD61C310EDAF01E618BE9C1C79239E0C8CDEC85792624A7CCE1B6251B0ADE066B8610AFDB0179F3EF474503890642284800B81E599CB830EC6C7C9AA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mexico_City)]} {. LoadTimeZoneFile America/Mexico_City.}.set TZData(:Mexico/General) $TZData(:America/Mexico_City).

C:\ProgramData\assignee\tcl\tzdata\NZ

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.8398862338201765
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL5E1nUDH/uvn:SlSWB9IZaM3ycqIVAIgOboLivn
MD5:	7B274C782E9FE032AC4B3E137BF147BB
SHA1:	8469D17EC75D0580667171EFC9DE3FDF2C1E0968
SHA-256:	2228231C1BEF0173A639FBC4403B6E5BF835BF5918CC8C16757D915A392DBF75
SHA-512:	AE72C1F244D9457C70A120FD00F2C0FC2BDC467DBD5C203373291E00427499040E489F2B1358757EA281BA8143E28FB54D03EDE67970F74DACFCB308AC7F74CE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:NZ) $TZData(:Pacific/Auckland).

C:\ProgramData\assignee\tcl\tzdata\NZ-CHAT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.832832776993659
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9WQ+DdVAIgObT9WQrF5AmtBFB/pUDH9WQpn:SlSWB9IZaM3ycwQ+DdVAIgObwQ5zzJjA
MD5:	C8D83C210169F458683BB35940E11DF6
SHA1:	278546F4E33AD5D0033AF6768EFAB0DE247DA74F
SHA-256:	CECF81746557F6F957FEF12DBD202151F614451F52D7F6A35C72B830075C478D
SHA-512:	4539AE6F7AF7579C3AA5AE4DEB97BD14ED83569702D3C4C3945DB06A2D8FFF260DA1DB21FF21B0BED91EE9C993833D471789B3A99C9A2986B7AC8ABFBBE5A8B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chatham)]} {. LoadTimeZoneFile Pacific/Chatham.}.set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham).

C:\ProgramData\assignee\tcl\tzdata\Navajo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.80475858956378
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L5vf1+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLpd+90+u
MD5:	38C56298E75306F39D278F60B50711A6
SHA1:	8FD9CEAD17CCD7D981CEF4E782C3916BFEF2D11F
SHA-256:	E10B8574DD83C93D3C49E9E2226148CBA84538802316846E74DA6004F1D1534D
SHA-512:	F6AA67D78A167E553B97F092CC3791B591F800A6D286BE37C06F7ECABDFBCF43A397AEDC6E3EB9EB6A1CB95E8883D4D4F97890CA1877930AFCD5643B0C8548E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:Navajo) $TZData(:America/Denver).

C:\ProgramData\assignee\tcl\tzdata\PRC

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.854287452296565
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtAnL75h4WFKdv:SlSWB9IZaM3yMwVAIgEH5h4wKt
MD5:	AF9DD8961DB652EE1E0495182D99820D
SHA1:	979602E3C59719A67DE3C05633242C12E0693C43
SHA-256:	9A6109D98B35518921E4923B50053E7DE9B007372C5E4FFF75654395D6B56A82
SHA-512:	F022C3EFABFC3B3D3152C345ACD28387FFEA4B61709CBD42B2F3684D33BED469C4C25F2328E5E7D9D74D968E25A0419E7BCFF0EB55650922906B9D3FF57B06C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:PRC) $TZData(:Asia/Shanghai).

C:\ProgramData\assignee\tcl\tzdata\PST8PDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.751820462019181
Encrypted:	false
SSDEEP:	96:9d89jJC2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:49jgNf+aNwj/lpmlOxnKcndIG
MD5:	DB5250A28A3853951AF00231677AACAC
SHA1:	1FC1DA1121B9F5557D246396917205B97F6BC295
SHA-256:	4DFC264F4564957F333C0208DA52DF03301D2FD07943F53D8B51ECCDD1CB8153
SHA-512:	72594A17B1E29895A6B4FC636AAE1AB28523C9C8D50118FA5A7FDFD3944AD3B742B17B260A69B44756F4BA1671268DD3E8223EF314FF7850AFB81202BA2BBF44
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:PST8PDT) {. {-9223372036854775808 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-84376800 -25200 1 PDT}. {-68655600 -28800 0 PST}. {-52927200 -25200 1 PDT}. {-37206000 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -288

C:\ProgramData\assignee\tcl\tzdata\Pacific\Apia

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5521
Entropy (8bit):	3.7636237147984435
Encrypted:	false
SSDEEP:	96:2t8v71A1CBb1ZPJ/lU/x4WvZgJNzBNZVm:2t8v71A1iZDg1vSi
MD5:	6317E501CE36F8E669584D7375301366
SHA1:	1BB0BC2697267F3EF405A891784BF5070DE8F0FB
SHA-256:	0BBBAA5FE0F2238378E31D0ADF6F216AEF2B3428EA52D6F2A5A5ABCFBCA08C74
SHA-512:	C7581441B302DCA818825A8B715428C70D638A7FC889939DBF80F60FFB026CBC95C2C09470E4BC1557C1A063A92C3243FD8D8C576C3DD0C85AEE954C16F757B4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Apia) {. {-9223372036854775808 45184 0 LMT}. {-2855737984 -41216 0 LMT}. {-1861878784 -41400 0 SAMT}. {-631110600 -39600 0 WST}. {1285498800 -36000 1 WSDT}. {1301752800 -39600 0 WST}. {1316872800 -36000 1 WSDT}. {1325239200 50400 1 WSDT}. {1333202400 46800 0 WST}. {1348927200 50400 1 WSDT}. {1365256800 46800 0 WST}. {1380376800 50400 1 WSDT}. {1396706400 46800 0 WST}. {1411826400 50400 1 WSDT}. {1428156000 46800 0 WST}. {1443276000 50400 1 WSDT}. {1459605600 46800 0 WST}. {1474725600 50400 1 WSDT}. {1491055200 46800 0 WST}. {1506175200 50400 1 WSDT}. {1522504800 46800 0 WST}. {1538229600 50400 1 WSDT}. {1554559200 46800 0 WST}. {1569679200 50400 1 WSDT}. {1586008800 46800 0 WST}. {1601128800 50400 1 WSDT}. {1617458400 46800 0 WST}. {1632578400 50400 1 WSDT}. {1648908000 46800 0 WST}. {1664028000 50400 1 WSDT}. {1680357600 46800 0

C:\ProgramData\assignee\tcl\tzdata\Pacific\Auckland

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8487
Entropy (8bit):	3.8173754903771018
Encrypted:	false
SSDEEP:	96:WNj7nBIc0fw4eJ7a1N1oKe13aNiWbF8sYBpYhuVn:Cmc3J7a1N18QOs8
MD5:	6C008D6437C7490EE498605B5B096FDB
SHA1:	D7F6E7B3920C54EFE02A44883DBCD0A75C7FC46A
SHA-256:	B5BD438B748BA911E0E1201A83B623BE3F8130951C1377D278A7E7BC9CB7F672
SHA-512:	DA6992D257B1BA6124E39F90DDEE17DC3E2F3B38C3A68B77A93065E3E5873D28B8AE5D21CEC223BAADFBDD1B3A735BF1CEC1BDEB0C4BEAB72AAA23433A707207
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Auckland) {. {-9223372036854775808 41944 0 LMT}. {-3192435544 41400 0 NZMT}. {-1330335000 45000 1 NZST}. {-1320057000 41400 0 NZMT}. {-1300699800 43200 1 NZST}. {-1287396000 41400 0 NZMT}. {-1269250200 43200 1 NZST}. {-1255946400 41400 0 NZMT}. {-1237800600 43200 1 NZST}. {-1224496800 41400 0 NZMT}. {-1206351000 43200 1 NZST}. {-1192442400 41400 0 NZMT}. {-1174901400 43200 1 NZST}. {-1160992800 41400 0 NZMT}. {-1143451800 43200 1 NZST}. {-1125914400 41400 0 NZMT}. {-1112607000 43200 1 NZST}. {-1094464800 41400 0 NZMT}. {-1081157400 43200 1 NZST}. {-1063015200 41400 0 NZMT}. {-1049707800 43200 1 NZST}. {-1031565600 41400 0 NZMT}. {-1018258200 43200 1 NZST}. {-1000116000 41400 0 NZMT}. {-986808600 43200 1 NZST}. {-968061600 41400 0 NZMT}. {-955359000 43200 1 NZST}. {-936612000 41400 0 NZMT}. {-923304600 43200 1 NZST}. {-757425600 43200

C:\ProgramData\assignee\tcl\tzdata\Pacific\Chatham

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7875
Entropy (8bit):	3.897879639687008
Encrypted:	false
SSDEEP:	96:46x7dZGlv6WzAqqHqZnKNzBXaQY6CVXbiMKOVw:4EZqzAqqHqUYFVE
MD5:	57E04BB83BF3FEA0F80DB32D1B2AF477
SHA1:	29F1CB5FC4B5B24177B6345597E859B4BE172557
SHA-256:	CB717076A5F6AD10DF3F6D81D079DC6DE6E600765648A461A2815ADC9D2E9011
SHA-512:	72CE829F71A244CB21BB5752E44016AC6B702647422CE638DE91819D5BD41363EABB8B5142CF375520CED3D16B45B7B4BDC3E1256316062632A28FEAB3E7E626
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chatham) {. {-9223372036854775808 44028 0 LMT}. {-410271228 45900 0 CHAST}. {152632800 49500 1 CHADT}. {162309600 45900 0 CHAST}. {183477600 49500 1 CHADT}. {194968800 45900 0 CHAST}. {215532000 49500 1 CHADT}. {226418400 45900 0 CHAST}. {246981600 49500 1 CHADT}. {257868000 45900 0 CHAST}. {278431200 49500 1 CHADT}. {289317600 45900 0 CHAST}. {309880800 49500 1 CHADT}. {320767200 45900 0 CHAST}. {341330400 49500 1 CHADT}. {352216800 45900 0 CHAST}. {372780000 49500 1 CHADT}. {384271200 45900 0 CHAST}. {404834400 49500 1 CHADT}. {415720800 45900 0 CHAST}. {436284000 49500 1 CHADT}. {447170400 45900 0 CHAST}. {467733600 49500 1 CHADT}. {478620000 45900 0 CHAST}. {499183200 49500 1 CHADT}. {510069600 45900 0 CHAST}. {530632800 49500 1 CHADT}. {541519200 45900 0 CHAST}. {562082400 49500 1 CHADT}. {573573600 45900 0 CHAST}. {594136800

C:\ProgramData\assignee\tcl\tzdata\Pacific\Chuuk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	5.020357159210726
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH9CoFeEXGm2OHIOYvXmdcnWZ8bC:SlSWB9X5ZzLm2OHNYPmdc/bC
MD5:	384B69A22456509C37FCA84DC783FE69
SHA1:	498A077DC6FE4268B548CD1153F4B709DC05D88A
SHA-256:	DFBA5B3067135BF4710D4F7DCDD39A2BFEB6F5DA034DE3169AD974EBA5F6D5F2
SHA-512:	D43659CF2E513774047858D11EE0780C623EAE2F07BACEE311D969B34F809C4A27469175D95623F9E4281B9FEBC74A77C5952519A9B681FA2621C4BE2695A02C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chuuk) {. {-9223372036854775808 36428 0 LMT}. {-2177489228 36000 0 CHUT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Easter

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8549
Entropy (8bit):	3.8169772089439093
Encrypted:	false
SSDEEP:	96:MYF9uZ14H1W5SbHM2Kv2kf+PanZQetG5lZNkOvhZGG4/pOP8x:MYF9uZ1GWcb62kf+PanzG5vnpdPi
MD5:	F13A3988AA8D7F97E5119C4E6810EA35
SHA1:	55800318CFE9FDFEB920BB79EFFE0C29690CF59C
SHA-256:	6BA1CA629B4FD6996674C68812A08CEDBFBDA8E35431002B650ECB49964FE450
SHA-512:	43D04D0BFBEF5936DE77E52D8D662639995E03E15686CE8112703F8B273A71B0AD03F1BF15AC952DAEB88DAD3EAEAD28019B845C07139069F30F9636FB5CC922
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Easter) {. {-9223372036854775808 -26264 0 LMT}. {-2524495336 -26248 0 EMT}. {-1178124152 -21600 0 EASST}. {-870552000 -25200 0 EAST}. {-865278000 -21600 1 EASST}. {-740520000 -21600 1 EASST}. {-736376400 -25200 0 EAST}. {-718056000 -25200 0 EAST}. {-36619200 -21600 1 EASST}. {-23922000 -25200 0 EAST}. {-3355200 -21600 1 EASST}. {7527600 -25200 0 EAST}. {24465600 -21600 1 EASST}. {37767600 -25200 0 EAST}. {55915200 -21600 1 EASST}. {69217200 -25200 0 EAST}. {87969600 -21600 1 EASST}. {100666800 -25200 0 EAST}. {118209600 -21600 1 EASST}. {132116400 -25200 0 EAST}. {150868800 -21600 1 EASST}. {163566000 -25200 0 EAST}. {182318400 -21600 1 EASST}. {195620400 -25200 0 EAST}. {213768000 -21600 1 EASST}. {227070000 -25200 0 EAST}. {245217600 -21600 1 EASST}. {258519600 -25200 0 EAST}. {277272000 -21600 1 EASST}. {289969200 -25200 0 EAST}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Efate

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	715
Entropy (8bit):	4.173737610787593
Encrypted:	false
SSDEEP:	12:MBp5cJmdH6mvqjlX/xS9djXpps3FX9komeXv:cuesjlc9dXEFHb
MD5:	CD5F959DA100D67198E3B4A8CD6B8E42
SHA1:	C56FA79E3B1E3ABFCF4051514C008FBCBD8EEE8E
SHA-256:	A36B2311713F58916055594E428AAE36CC8575842087C57012F2CD71F5F5AE1B
SHA-512:	A5A483929BD0F7DFA6CD4B3BF303BAE9F20BFC8FFB021964173E42BF2B1CA547B533D7E8C18F799B1E96D3FCECE741DEAEEA95254912ED82BBF22B84FB4D740D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Efate) {. {-9223372036854775808 40396 0 LMT}. {-1829387596 39600 0 VUT}. {433256400 43200 1 VUST}. {448977600 39600 0 VUT}. {467298000 43200 1 VUST}. {480427200 39600 0 VUT}. {496760400 43200 1 VUST}. {511876800 39600 0 VUT}. {528210000 43200 1 VUST}. {543931200 39600 0 VUT}. {559659600 43200 1 VUST}. {575380800 39600 0 VUT}. {591109200 43200 1 VUST}. {606830400 39600 0 VUT}. {622558800 43200 1 VUST}. {638280000 39600 0 VUT}. {654008400 43200 1 VUST}. {669729600 39600 0 VUT}. {686062800 43200 1 VUST}. {696340800 39600 0 VUT}. {719931600 43200 1 VUST}. {727790400 39600 0 VUT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Enderbury

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.866634190114019
Encrypted:	false
SSDEEP:	6:SlSWB9X5Vm2OH1oePmWXAxYTBVyvCxYXqxYAvn:MBp5VmdH15PZQeTBVyaeXqeKn
MD5:	F8B4BC5A94B735E7E69CCEA302BB2403
SHA1:	926469170816AD71495B3EEEA42B9EDE9FC34D10
SHA-256:	53DD9664FFA42637EF8A28C648C83C0539FF571135B30D0225A7551BAEE3A8B4
SHA-512:	3B68F76797C14D19EFC01E48EC27B5B69D37B58025B446821210245894AAFD14B909E660E083FB7A6121F89F6276393BF20087FC14072D4CFB61917D95A597C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Enderbury) {. {-9223372036854775808 -41060 0 LMT}. {-2177411740 -43200 0 PHOT}. {307627200 -39600 0 PHOT}. {788958000 46800 0 PHOT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Fakaofo

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.891537262328573
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH4ErKYvcXGm2OH18VkevXmUENZF8CPFVFvxC:SlSWB9X5BE3Lm2OH1VePmHlO
MD5:	54E73EF1365211F15B41DE32F7167ECB
SHA1:	379DA4F84F59FF1D427227F173F77B6C6C5F9506
SHA-256:	BB4A1DA9BD1AD19B857D94840E1C8CF9445CFD32A218959275C137C2B4637F78
SHA-512:	E6FB9F2C3D946493A618CFCFEDA8A639522AB8DEE75B0F7F6107A14691B6A4550516AD9B5705367A83B7143C3F8C32A34EAD06BBC96A3FC096713F8E1F449671
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fakaofo) {. {-9223372036854775808 -41096 0 LMT}. {-2177411704 -39600 0 TKT}. {1325242800 46800 0 TKT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Fiji

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5598
Entropy (8bit):	3.766928177870911
Encrypted:	false
SSDEEP:	96:9WZgEMIK3JROuuo/rLaJzNqZsz9O535C9JMcT:cZxMIK3JROgrLKzNdzAOT
MD5:	1AC9829607784A280AC8BAC239B71B2F
SHA1:	7B1175D5571D48DE5D3E4507CC3AD17E55EEE47B
SHA-256:	0A1B1B3C3CC45D7FF4627F56248E86C593CEE9E5C81ACB57DEFF3B065D1A0649
SHA-512:	2E409D6C02EB3CFD8320AA107494AD8285A9FB56B25ACF44B824E13A2E357E4C07F35DB265D14E2A47ECD7C1D991039288DB3182DA39FE2926B7FD2C4D0B5AA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fiji) {. {-9223372036854775808 42944 0 LMT}. {-1709985344 43200 0 FJT}. {909842400 46800 1 FJST}. {920124000 43200 0 FJT}. {941896800 46800 1 FJST}. {951573600 43200 0 FJT}. {1259416800 46800 1 FJST}. {1269698400 43200 0 FJT}. {1287842400 46800 1 FJST}. {1299333600 43200 0 FJT}. {1319292000 46800 1 FJST}. {1327154400 43200 0 FJT}. {1350741600 46800 1 FJST}. {1358604000 43200 0 FJT}. {1382191200 46800 1 FJST}. {1390053600 43200 0 FJT}. {1413640800 46800 1 FJST}. {1421503200 43200 0 FJT}. {1445090400 46800 1 FJST}. {1453557600 43200 0 FJT}. {1477144800 46800 1 FJST}. {1485007200 43200 0 FJT}. {1508594400 46800 1 FJST}. {1516456800 43200 0 FJT}. {1540044000 46800 1 FJST}. {1547906400 43200 0 FJT}. {1571493600 46800 1 FJST}. {1579356000 43200 0 FJT}. {1602943200 46800 1 FJST}. {1611410400 43200 0 FJT}. {1634997600 46800 1 FJST}. {1

C:\ProgramData\assignee\tcl\tzdata\Pacific\Funafuti

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.985758985032215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH4QwyFtXGm2OHwodGevXmcpXrWXVNLJ:SlSWB9X5BCEm2OHwxePmgSX9
MD5:	293C8D6A5B95345A03AC1E6B69A74F37
SHA1:	D3225A06754C703F60A5A2E31C35270DFD705E62
SHA-256:	A56BF48B6DE9424A68BBFC11F4AC942562BFB4F001FE90B7DDA754FBA4F5A558
SHA-512:	7AD32701656A8571481C59777EB8E51318B181EC7F8CC9249F15920FC838546A9525567B4E2AAD802A6A19DC4BD3BE775342827216687EEC18911AF900CF78BD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Funafuti) {. {-9223372036854775808 43012 0 LMT}. {-2177495812 43200 0 TVT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Galapagos

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.944898590958793
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5gENFFFkXGm2OHvQYevUXSiT67vaPlrRncRvkC:SlSWB9X5fEjFJm2OHvQYezie7iNRncRB
MD5:	8D32FCC81C3899BE8A15BFB1B2742100
SHA1:	86A1D95D455DD42D7CC1BDCAF87623079431B7FB
SHA-256:	5BB9104ADB654518CE92768C5B39DAD95053EB626B8C779A1F8ECDF0EB94BCC2
SHA-512:	7F34361986B89171691C4522E282F5AF63D18B56CE5AE3992E9CAE5AAE5AFA2D171C73A3DBFA009088E0DA7994CD5A8F5B85481E2933D87088A14891B28F1730
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Galapagos) {. {-9223372036854775808 -21504 0 LMT}. {-1230746496 -18000 0 ECT}. {504939600 -21600 0 GALT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Gambier

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.980881214713058
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5hBfcXGm2OHKToxYvUdNf7Avn:SlSWB9X5kTm2OHPxYY2n
MD5:	B907AF758AD42A914DECD0E470197DDA
SHA1:	4414D5ACA47E1EA5846C5314279987FEF3DA7B9E
SHA-256:	9B907D9DFEF6AC1ACAEF6B85C879FF88D82157187A9A7F063001101887E30213
SHA-512:	A421C0EE1ACFF603DC86F11C7BDEC0532C21BFDDB7A2AE0053FA8ACC536BEFC13435D043B590EC4D073D72207FA8DB8C8714611DE3FF40AFFA9484F2119425A6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Gambier) {. {-9223372036854775808 -32388 0 LMT}. {-1806678012 -32400 0 GAMT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Guadalcanal

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.94737487926159
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5RyJTLJyFkXGm2OHddHvpoxYvUdMWdHPuCYv:SlSWB9X5LJHgm2OHdFGxYAHP/C
MD5:	5FEB2243117640E2828308B479E3BD94
SHA1:	D5766763E793ADA6C9CDD6ED415178EA395D80F6
SHA-256:	B11415B7DDC5077FA4D902C41F0FECC5918E3FE3612E38166EC71C443D0601B3
SHA-512:	618B1AC050E9D5CD8ECA7E4ADD5C7AB41B47553B6912D17AE5A117DBE2E68AE226F5CD02F8064872FF34DA32DFA07E81A67F129624BB39E1C59508DD77BE9C52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guadalcanal) {. {-9223372036854775808 38388 0 LMT}. {-1806748788 39600 0 SBT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Guam

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.833752908914461
Encrypted:	false
SSDEEP:	6:SlSWB9X5bm2OHauezyRtAePmdSUUyWGHZFUeMn:MBp5bmdHanzCtBP1yWleMn
MD5:	AD14439D9E27F2D3545E17082150DC75
SHA1:	43DE1D4A90ABE54320583FAB46E6F9B428C0B577
SHA-256:	CE4D3D493E625DA15A8B4CD3008D9CBDF20C73101C82F4D675F5B773F4A5CF70
SHA-512:	77800323ED5AF49DA5E6314E94938BEAAEDD69BB61E338FAF024C3A22747310307A13C6CBBAFE5A48164855B238C2CAD354426F0EE7201B4FB5C129D68CB0E3B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guam) {. {-9223372036854775808 -51660 0 LMT}. {-3944626740 34740 0 LMT}. {-2177487540 36000 0 GST}. {977493600 36000 0 ChST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Honolulu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.60985382453312
Encrypted:	false
SSDEEP:	6:SlSWB9X5PeQm2OHsVVPBraX3UNFvDrUXa91dFNFvlY7p0:MBp5WQmdH0VPBa0VOeFNs7O
MD5:	332B4D9334415628E98DB46AE75E3AEB
SHA1:	DD1E206C22916DFE9A76FE3F4125D42D497505C0
SHA-256:	346A2A7580BB2ACDA28ECA23B19B12561101C615A539A4E8483D1A9B7CC19E2B
SHA-512:	30F26AD35DF10615F04AB6FE7085C102CE95857B01A5443108BA1B01AD8D0C0A21AEBB10C583607C5323D36D4EC2938AFD36B00662C3A9FFE3AFE7A8214EA36B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Honolulu) {. {-9223372036854775808 -37886 0 LMT}. {-2334101314 -37800 0 HST}. {-1157283000 -34200 1 HDT}. {-1155436200 -37800 0 HST}. {-880198200 -34200 1 HDT}. {-765376200 -37800 0 HST}. {-712150200 -36000 0 HST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Johnston

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	119
Entropy (8bit):	4.982530843224082
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH0KNyavFFkXGm2OH1V9i:SlSWB9X5NWyavTm2OH1V8
MD5:	F8D3FCC34AB9585C2943ACA3F7B6BD50
SHA1:	515A0AE2A7DA8005A9F045ACAA09E9D7772CC3C0
SHA-256:	5184812CA727990AA3E1F9FEC860E47D48AAE0B7243F9790F80F1932C84AF248
SHA-512:	E2B42F36DDF4A15AAAB98D9A04F308D5D0F84353BD66AF05544E60F56291746C3CEC2A63D4ED347D4389C11BB0A026FBCA298D9E54D29FA56844BDAE71532D87
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Johnston) {. {-9223372036854775808 -36000 0 HST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Kiritimati

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.792256891473366
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH1meEXGm2OHjToevXmUBesG/94vxqG/5eEzvAzvV+L:SlSWB9X5iLm2OHjkePmvF4TRdvAzvo
MD5:	AD91217DF716934F3F3576C643104AC3
SHA1:	89211341D2BBB0E0D9769CDD85F68AC1EB4C7F12
SHA-256:	786830AF5A02D4DD7630AFFFBCB0CA470B725B59BE1BE35EC0CC294344A659FB
SHA-512:	83498C4670603C39E536638981AD6D9DC31C0D6FCA70AFEFA54C0610EF6A62C51DDC66DD3F055B8A6D22B27A7B10E96A883D901AB4DDF06A249FEB880417B99D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kiritimati) {. {-9223372036854775808 -37760 0 LMT}. {-2177415040 -38400 0 LINT}. {307622400 -36000 0 LINT}. {788954400 50400 0 LINT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Kosrae

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.850978033001401
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH1+AtFkXGm2OHHvvXmc03VMcfzvwXUnQ9+vn:SlSWB9X598Jm2OHHvPmbdLYXUQ2n
MD5:	6C04086C1204942EBED676749791DC43
SHA1:	3690C656C5B9F637CA6F9A86BA7AFA4CB885E4E1
SHA-256:	61472E0809D0821EA1DCCBF813D6552E87A69AB0C4915FD0E838854AAA68BBD3
SHA-512:	3629A4F71536562D1311A46339779444BCBCDCCBDF11C2E7DBCB43DDE3E097209DFA4490CD1C2B60E3A226D5756BF3D0A87460967CFB6AAE3A75C288EB641A5D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kosrae) {. {-9223372036854775808 39116 0 LMT}. {-2177491916 39600 0 KOST}. {-7988400 43200 0 KOST}. {915105600 39600 0 KOST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Kwajalein

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.857886519292782
Encrypted:	false
SSDEEP:	6:SlSWB9X5yErm2OH4T2ePmX/nL/XU2rHSGC:MBp5XrmdHWPAnLc2ra
MD5:	8CD11D61E173AACA85761ABEE3659CC1
SHA1:	1B6AE8331FD50D11BA4CA6E27B5CB88C25D6FE17
SHA-256:	5D6C074A0F474FD0E0D814C43E952922023ED0FC4DE3062464AA8E6DBAA24A96
SHA-512:	AD4B1EA03C861DD1C5AF34B9658AE0A4FDAF0DF1F53BBF7660077670BAB14318889BB5076F784E557DB5CA696E66EE4B2600BC61D25A596096A619991D3D0BF4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kwajalein) {. {-9223372036854775808 40160 0 LMT}. {-2177492960 39600 0 MHT}. {-7988400 -43200 0 KWAT}. {745848000 43200 0 MHT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Majuro

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.877232573489241
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHznHLXGm2OHy3HuxYvXmcQ/2C/qcfzvwXSDCYv:SlSWB9X5Qim2OHyexYPmf/n/nLYXSGC
MD5:	5261FDFED2D54973D4639EDD2D65EF17
SHA1:	C0FEC40C57997D82857E4198BE449B6418438764
SHA-256:	086136AEA9C376BDBFC7C5FA3A5DE2C226FAE8772EFCF22DA5BFE3AE553F1964
SHA-512:	0894E6A59AC3DDDC41E88FCFBD60026A66121D6B1B656F2C37E33A931FDD6519FE5A4ABF10B8AB9BFBAD172377DBF12BD9D536A6F43456208AA39C3F033700BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Majuro) {. {-9223372036854775808 41088 0 LMT}. {-2177493888 39600 0 MHT}. {-7988400 43200 0 MHT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Marquesas

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.003270425254343
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHzrHeHkXGm2OHOx5vUdNpNFvvo+wC:SlSWB9X5cHeLm2OHOnY/Fvw+d
MD5:	0F8F87DE1CA006F89A7800CE49724C02
SHA1:	7C69C9EF2B8177C152E6070FCDA32EBF1F4A24C2
SHA-256:	27968B2CE721B5B1D2B13596B2537930B70CFD2F755A14BE7F7BCE6EAE58E0C3
SHA-512:	5A31DD7A50081A3BFD7B2E31D1E866F3DEB18062D3B7F57A2CBF5326BA1A802FC7D9CD02BDB303B8A46ABACDC3A2CCFFA096180FA86557E37B4A4B6351333A6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Marquesas) {. {-9223372036854775808 -33480 0 LMT}. {-1806676920 -34200 0 MART}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Midway

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.674301997437706
Encrypted:	false
SSDEEP:	6:SlSWB9X5aTm2OHjeYPmWFZv1WhpYgv5cIlvK8KlvvL:MBp5+mdH6YP57IUg/lslHL
MD5:	C008BBDA68C99033D86309B7802F8D29
SHA1:	1682354E5E119D012916BC66DD3277CC4521934E
SHA-256:	E9004F570D426D0D457DFB20E23634D085472DA7367503CFB1DB532FB0351108
SHA-512:	5C11479D441C4C7E2C0BD551CCE8983FA3B4939CC7D897EE6156ED063417893B9197CD28D4E835F9EFE6C76B92F763C71801181BEDA94A334026D29F4EFC8F67
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Midway) {. {-9223372036854775808 -42568 0 LMT}. {-2177410232 -39600 0 NST}. {-428504400 -36000 1 NDT}. {-420645600 -39600 0 NST}. {-86878800 -39600 0 BST}. {439038000 -39600 0 SST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Nauru

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.69970338626088
Encrypted:	false
SSDEEP:	6:SlSWB9X5Jem2OHceR6sCHSd0ikvmmpSTcXSC:MBp5JemdH9sS2ZrSTTC
MD5:	C6F2C18864E7ACC10DB54B4192D10743
SHA1:	76C6975D6B225045B22426ECEFCB0C16FC084A27
SHA-256:	83C45CFDDE3005E1E8115E4B82286A9D2511AD56013AAD1CC1693613B13279BD
SHA-512:	D6FC793CA91CDAA66DBE3EB572C8BF6D315C64002B4C53A803E9ECA95EBD0EAC2F291E5649D620CAB57EDF4AD3A4249B30D1A111088435CC97B64B8923C4BB8E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Nauru) {. {-9223372036854775808 40060 0 LMT}. {-1545131260 41400 0 NRT}. {-877347000 32400 0 JST}. {-800960400 41400 0 NRT}. {294323400 43200 0 NRT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Niue

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.766990097413265
Encrypted:	false
SSDEEP:	6:SlSWB9X5Jm3Lm2OHJPm60GIJNsY2rGvALn:MBp5JmbmdHJPB0GnY2rGIL
MD5:	4218B8B651FA2BD5BD2697A6BC9D9F3F
SHA1:	D9B0AE5833D021D472F6014151FD251EA9433555
SHA-256:	EC1D37C55E24C874B1FB95A6A561B0C5951573730D602852639DFCE07BCC38F2
SHA-512:	26A5CC7B2379A6BDB9F7354E966E5CFFAB0E796F3364966561787708DA2FBDB34695DFE773009CA3658179E8C1BB1C05D0CD870B1E5104F51D9287ED0D99B4BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Niue) {. {-9223372036854775808 -40780 0 LMT}. {-2177412020 -40800 0 NUT}. {-599575200 -41400 0 NUT}. {276089400 -39600 0 NUT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Norfolk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.924281939518807
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHwKGpkvcXGm2OHzWU/ToevXmcY2FgYvFFociQkEFgC:SlSWB9X5JJpkLm2OH6uToePmUgYhiQHf
MD5:	415E429B5630BA3E5B8A3EF59848BA58
SHA1:	BA52D81F82742719590102688AA99991AB919384
SHA-256:	35B5FAEA5D9B8267E89BE58F2E8DCB4D5DCC3B37F2A08FDB12BBDB1B26692634
SHA-512:	A91B45DDA7ABD92C500ABA2939B31D28581882D22A648F39227F494044CA197A1BA271521AB699E9C444B38E0D77D25A8BFBB8E7273FBF801C3E4963AEA3BF71
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Norfolk) {. {-9223372036854775808 40312 0 LMT}. {-2177493112 40320 0 NMT}. {-599656320 41400 0 NFT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Noumea

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.558916369175064
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHwKC2dSXGm2OHTYvUdGyRF/nVvVCXG9WzvWwF/m6FT9qZj:SlSWB9X5JcdJm2OHTYAOX5zOeFgw6S6
MD5:	BB195BFAAD0B4611E1BAD6C9A89A26C6
SHA1:	9B371CFE253882C22CBD6143A135FE7F89F3401B
SHA-256:	50D7C34FB60A17581288E243F87A45EB8BFF86FF49BC5092D98E17BD8DC76342
SHA-512:	0D30F9525729DAEA8ABCF60BA5788F91E2BED88FC84CEB0A04BB0510FFCEEE526AD042A18B32B1D4765C620E2B7595043AAFE76CEAE72CBBA0645CF5F102F1A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Noumea) {. {-9223372036854775808 39948 0 LMT}. {-1829387148 39600 0 NCT}. {250002000 43200 1 NCST}. {257342400 39600 0 NCT}. {281451600 43200 1 NCST}. {288878400 39600 0 NCT}. {849366000 43200 1 NCST}. {857228400 39600 0 NCT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Pago_Pago

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.748706994602888
Encrypted:	false
SSDEEP:	6:SlSWB9X5XevJm2OH23ePuneYCRv/Fav5cIlvK8KlvvL:MBp5GJmdH2uPTYCRvNa/lslHL
MD5:	CD1A6140AE4EBC44537E8F097F247CBD
SHA1:	F2485773A5C1617A77F39DE864166226E5BBCE74
SHA-256:	1FC256AA502E9269971C3810BCC0993B6D34D04CB540560ED3872158FF3A779B
SHA-512:	4FA91751A51AA6E84038D5945DBCCE58795EE7AD6FBE3EF6CFD699ECFDC6F950F350EBD5F4D0F4FB1F4CBFE074DED602986268D18754060AD1D33DB484CDBAA8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pago_Pago) {. {-9223372036854775808 45432 0 LMT}. {-2855738232 -40968 0 LMT}. {-1861879032 -41400 0 SAMT}. {-631110600 -39600 0 NST}. {-86878800 -39600 0 BST}. {439038000 -39600 0 SST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Palau

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.926225749796432
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHugEZFwcXGm2OHCAnvXmdQ4+vY:SlSWB9X5Xg2wTm2OHPnPmdQRvY
MD5:	39822D6A510FEF24D476D12C61D3EED6
SHA1:	7E60BA857738EFDB4EE3303F1BA1CB8028D3549F
SHA-256:	9F0C8FD0A47D561E7198F2935482B873039D6E36DB2E9435E89CD4663F08F9F8
SHA-512:	7D19E2B0CB7460323D25CCEA60208EBDF944448E25C83E8AF6C063E3213739A35CA28FA657E70E69510255F07BBA4B8FB101E766EEAFC8D7B957AE029804D6EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Palau) {. {-9223372036854775808 32276 0 LMT}. {-2177485076 32400 0 PWT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Pitcairn

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.856366586274156
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuQTWLMWkXGm2OHUVFvvXmXUlglSFycyf/vHvYvn:SlSWB9X5XQyLMCm2OHUVVPmXUKEEhf/y
MD5:	007CAABA7DF754D780A221DEA81C2BF7
SHA1:	E2A58CCEF4A5425CB7197D5F7D7982F8A970AB3F
SHA-256:	73024A9A7CCFAEE298560C4B857288C46C4A3F643141A09457922D9C6E7771AB
SHA-512:	27FD492D7AE74832493505B2AAE3645D86E185E16E7A36EE747C0340619BD0A4CC042D613C92FF636807826B2F3BB2D80F0925DC240835298E2CDE0F66287515
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pitcairn) {. {-9223372036854775808 -31220 0 LMT}. {-2177421580 -30600 0 PNT}. {893665800 -28800 0 PST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Pohnpei

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.981615890085678
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuy3EXGm2OH1/VvXmcruL:SlSWB9X5Xybm2OH1NPmS6
MD5:	F931DC5DDDE5DA4DA24249DED18038C4
SHA1:	77BDDB2AD825452476D1A237C4EB4434DB33BEC6
SHA-256:	7A09D415E802BA784A04995023FF191D1406598C66E8D49F1AA9653B6C66E8E6
SHA-512:	F43F57375E414AFA35511B8751C756555FE33346A75159C171C977EBE80E2561C161B57DDFF912C56D66B935A14383693F1F253FF98779C2B7AC3A808211A234
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pohnpei) {. {-9223372036854775808 37972 0 LMT}. {-2177490772 39600 0 PONT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Ponape

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.735143778298082
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGuySedVAIgObTuyvQnUDHu3HppUDHuyu:SlSWB9IZaM3yciySedVAIgObiyvQX3HP
MD5:	C963ECC06914E8E42F0B96504C1F041C
SHA1:	82D256793B22E9C07362708EE262A6B46AC13ACD
SHA-256:	86593D3A9DC648370A658D82DA7C410E26D818DB2749B79F57A802F8CED76BD3
SHA-512:	0F3691977F992A3FF281AD1577BA0BD4AAF7DB3F167E1A1FF139374C14B14F1A456BE7E7D362D698A8294A6AB906E69AC56E1EE0DAF77C13050553299FB6DAF5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pohnpei)]} {. LoadTimeZoneFile Pacific/Pohnpei.}.set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei).

C:\ProgramData\assignee\tcl\tzdata\Pacific\Port_Moresby

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.910245509007629
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuwKXI3EXGm2OHwdvvXZUeQTnoowFZnqMVV3rvYvn:SlSWB9X5X/43Lm2OHwdvPZZQTnoDZDVA
MD5:	81139518ED3656B435EB868FB7686201
SHA1:	B80007B5DF07104F4FF01BF75D26647DF8D48932
SHA-256:	1619743B030B8E98B50B5DA732FF05F4AAF749C440914671186A0DF63A3DEDCB
SHA-512:	B8EC6D5A6B0214713896E4CFD1DB34BD129B416D6FB230AE4808E0BC63F19C6464C576D7F7C68A5D90D89EC96829F5A0972E5A86B584F2A684257686E576B4F8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Port_Moresby) {. {-9223372036854775808 35320 0 LMT}. {-2840176120 35312 0 PMMT}. {-2366790512 36000 0 PGT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Rarotonga

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	931
Entropy (8bit):	4.17207356431605
Encrypted:	false
SSDEEP:	12:MBp5VrsmdHAPS+GT0OvyXHghNFID8KnEUo8+If2aUqoYA+IokXj7VU/rOJzVovD8:ccekSh0oNFmNLR+4A/BO8
MD5:	AF517E0BF0AE91439ED8F72503A5534C
SHA1:	5A4376BA8CBBE50F29DEF952EC4D424E45EF72D9
SHA-256:	01506284169D88C126B4614805E127EED4A46B40E29ED542FC52840330013ABF
SHA-512:	4630C31EEFA40AB09480D36EF676F0A3BA9228FD4B91E1BF9E64A316EBEFF1D51674BE24E2973DADD2D2626A08AE564DCF4742CFBC04F359D8CA7AC782D32D26
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Rarotonga) {. {-9223372036854775808 -38344 0 LMT}. {-2177414456 -37800 0 CKT}. {279714600 -34200 0 CKHST}. {289387800 -36000 0 CKT}. {309952800 -34200 1 CKHST}. {320837400 -36000 0 CKT}. {341402400 -34200 1 CKHST}. {352287000 -36000 0 CKT}. {372852000 -34200 1 CKHST}. {384341400 -36000 0 CKT}. {404906400 -34200 1 CKHST}. {415791000 -36000 0 CKT}. {436356000 -34200 1 CKHST}. {447240600 -36000 0 CKT}. {467805600 -34200 1 CKHST}. {478690200 -36000 0 CKT}. {499255200 -34200 1 CKHST}. {510139800 -36000 0 CKT}. {530704800 -34200 1 CKHST}. {541589400 -36000 0 CKT}. {562154400 -34200 1 CKHST}. {573643800 -36000 0 CKT}. {594208800 -34200 1 CKHST}. {605093400 -36000 0 CKT}. {625658400 -34200 1 CKHST}. {636543000 -36000 0 CKT}. {657108000 -34200 1 CKHST}. {667992600 -36000 0 CKT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Saipan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.754190180492017
Encrypted:	false
SSDEEP:	6:SlSWB9X5vXm2OHQVVz8dRPmdSaFs7tWF5aHZFUeMn:MBp5vXmdHAVz87PUFktWFkAeMn
MD5:	1D669E303CE12C9582D52669B920B265
SHA1:	2050297F982EF610256061D224476D0DD71810C9
SHA-256:	CAEC3E3AE27B13E03368FE066842AF3C2D15DC9F88C92A00CA210B7DAA1D2B7E
SHA-512:	4A52BF8126D1C8D43F2208A796E3173521F5E09C27CAF270CD0CBDABFA527328DC939ADFCAC168033602E792EF62C3964C126C1D87B74972081C7AA9500360C0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Saipan) {. {-9223372036854775808 -51420 0 LMT}. {-3944626980 34980 0 LMT}. {-2177487780 32400 0 MPT}. {-7981200 36000 0 MPT}. {977493600 36000 0 ChST}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Samoa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.729839728044672
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHthA5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiNXeg
MD5:	843BBE96C9590D69B09FD885B68DE65A
SHA1:	25BF176717A4578447E1D77F9BF0140AFF18625A
SHA-256:	4F031CB2C27A3E311CA4450C20FB5CF4211A168C39591AB02EEEC80A5A8BFB93
SHA-512:	B50301CFC8E5CF8C257728999B0D91C06E2F7C040D30F71B90BBC612959B519E8D27EE2DA9B8B9002483D3F4F173BB341A07898B4E4C98A146B3D988CA3BD5B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago).

C:\ProgramData\assignee\tcl\tzdata\Pacific\Tahiti

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.950599400810649
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHqhFtXGm2OHl/oevUdNqoFC:SlSWB9X5TTEm2OHloeYqkC
MD5:	BE485E2362AF058E76E7EA0CC801A70E
SHA1:	7A5CA0369AB6367E21785ABF237DE1C5D2140198
SHA-256:	AC60ACF788A823379D879A294CC7126F48ADF3165BF695022839A740BD797AE1
SHA-512:	14A5879CCA33AAD4DC93D0F01B9199500982DFF31579581B89ACC166C6AFEDB2E5AB9C96314BE5ABBE2531EBEE881DA131E1C109B941EC5CED39AF0F277B1B1C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tahiti) {. {-9223372036854775808 -35896 0 LMT}. {-1806674504 -36000 0 TAHT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Tarawa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.948761121694915
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHqQwcXGm2OHyyFpoevXmciRrWFNYQ:SlSWB9X5TbTm2OHyyFGePmbuYQ
MD5:	3AC855D63D5AF3E79F2EAACAD253F675
SHA1:	5AF18E34FECFE2E1AFB78BF3AB0AFABEAF378403
SHA-256:	1B93CB46F9DE34EEE96ACD7856BCA5EBF251F5D6A750927BDF59FFE2CFE735D9
SHA-512:	9A24478D6E0C4128D298A4C493FB5AD7A570D42636FDF1730F4DCBDED1A514AD088C2A81EC45C9FA0DBFA4BE157A4D25FC425A20775EF2455A8DF0728CAA6AE0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tarawa) {. {-9223372036854775808 41524 0 LMT}. {-2177494324 43200 0 GILT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Tongatapu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.418587216893832
Encrypted:	false
SSDEEP:	6:SlSWB9X5TYJm2OHmCePm6z9Q2DpFmvwsvUOlaVRXzvUOf3RVf5bERvUO/6BAvn:MBp5kJmdHmLPJy2Dpcvw8UGulbUWFhA5
MD5:	6F2D2095FBFFC93C915E67672AF67B8F
SHA1:	0A724300EBA235B8AFE3F9C71DBAB053EFEDE375
SHA-256:	5A883E39019CFD2D49E7BFD3D13FF0D37793C3316F9F72609AADCA2D91D94788
SHA-512:	AFF123C1D148A8E828084CE7B46A2D81A863E1D95689F6D3A822312004B540EF4418F93E24258EAE535044898E30F76D03012BBD45A802526CA383E5EBF6694C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tongatapu) {. {-9223372036854775808 44360 0 LMT}. {-2177497160 44400 0 TOT}. {-915193200 46800 0 TOT}. {915102000 46800 0 TOT}. {939214800 50400 1 TOST}. {953384400 46800 0 TOT}. {973342800 50400 1 TOST}. {980596800 46800 0 TOT}. {1004792400 50400 1 TOST}. {1012046400 46800 0 TOT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Truk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.865414495402954
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHqAOsvUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkTAOmy
MD5:	3282C08FE7BC3A5F4585E97906904AE1
SHA1:	09497114D1EC149FB5CF167CBB4BE2B5E7FFA982
SHA-256:	DC6263DCC96F0EB1B6709693B9455CB229C8601A9A0B96A4594A03AF42515633
SHA-512:	077924E93AC9F610CD9FE158655B631186198BD96995428EB9EE2082449BD36CBF6C214D86E51A6D9A83329FCD5E931C343AA14DBB286C53071D46692B81BC0D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk).

C:\ProgramData\assignee\tcl\tzdata\Pacific\Wake

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.971563080524748
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHp8FkXGm2OH4VkxYvXmcDVvIntvn:SlSWB9X5PJm2OHYkxYPmyvIdn
MD5:	E014DF7A733F5F3EF751F40352DF71C4
SHA1:	531B4067E667E7842E1A1050ED46FEF64D454AAB
SHA-256:	99615042077FC57A894D26A3A5741BFB0A6C17A10BCFA31070BB074BCED2463A
SHA-512:	E4D274D33C1592DC2715A2CA28258029EFF7DA6BFE6B9B468758F5895F0110B4B45F0F4F930E9AF478ACBEB758D08510EA10BCF9F5BEC84F83C3DD95BAF9EC66
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wake) {. {-9223372036854775808 39988 0 LMT}. {-2177492788 43200 0 WAKT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Wallis

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.948108895609242
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHpEf/kXGm2OH3UPvXmcCRQHI0C:SlSWB9X5tfTm2OHkPPmiHI0C
MD5:	4A4929BB698224325D2EF6DCDAD12759
SHA1:	F009089E5048480E439B7BE7E4CABA8E8914C3C9
SHA-256:	91D903B7752BD5E73F1D509245DE9D9F3B38CF5CDFFC10CD62ACEB11AA4770C0
SHA-512:	1E823929F56572EBF4CDEED749B6BEC2816D25974F3ABE0924BF56F655F22E22BA9C451B5BEA59FF0C67F18181AA77080A5275687269D28BA8317EA72F13B406
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wallis) {. {-9223372036854775808 44120 0 LMT}. {-2177496920 43200 0 WFT}.}.

C:\ProgramData\assignee\tcl\tzdata\Pacific\Yap

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.887747451136248
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHnHPUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkeBy
MD5:	63594F45385660A04D21C11B5F203FF4
SHA1:	CEEC55B952B8EBA952E0965D92220C8EF001E59E
SHA-256:	4418559478B5881DFAF3FE3246A4BFE2E62C46C1D3D452EE4CF5D9651C4F92B5
SHA-512:	B9B55B027EFB7E87D44E89191C03A8409A16FA19A52032E29210161AE8FED528A6504B7B487181847125AF2C7C129A0687323CDDC6D5454199229897F97F0AB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk).

C:\ProgramData\assignee\tcl\tzdata\Poland

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.89278153269951
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVqEGIVyVAIgoqpEGuHtnSi67x/yQa0EGIv:SlSWB9IZaM3ymczVAIgocuN27x6qS
MD5:	975F22C426CE931547D50A239259609A
SHA1:	77D68DF6203E3A2C1A2ADD6B6F8E573EF849AE2E
SHA-256:	309DE0FBCCDAE21114322BD4BE5A8D1375CD95F5FC5A998B3F743E904DC1A131
SHA-512:	ABDF01FCD0D34B5A8E97C604F3976E199773886E87A13B3CDD2319A92BD34D76533D4BA41978F8AAA134D200B6E87F26CB8C223C2760A4D7A78CD7D889DB79BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Warsaw)]} {. LoadTimeZoneFile Europe/Warsaw.}.set TZData(:Poland) $TZData(:Europe/Warsaw).

C:\ProgramData\assignee\tcl\tzdata\Portugal

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.887895128079745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxMvLSwFVAIgoqyMvLN6nM24h8QavMvLu:SlSWB9IZaM3ymvMv2wFVAIgovMvUe81B
MD5:	31202B87B7352110A03D740D66DCD967
SHA1:	439A3700721D4304FA81282E70F6305BB3706C8D
SHA-256:	8288E9E5FC25549D6240021BFB569ED8EB07FF8610AAA2D39CD45A025EBD2853
SHA-512:	AB95D3990DC99F6A06BF3384D98D42481E198B2C4D1B2C85E869A2F95B651DDF64406AB15C485698E24F26D1A081E22371CE74809915A7CCA02F2946FB8607BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Lisbon)]} {. LoadTimeZoneFile Europe/Lisbon.}.set TZData(:Portugal) $TZData(:Europe/Lisbon).

C:\ProgramData\assignee\tcl\tzdata\ROC

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.743612967973961
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qMvedVAIgNqBolOr4WFKfMv:SlSWB9IZaM3yKMvedVAIgcBoS4wKfMv
MD5:	A0C5022166493D766E827B88F806CA32
SHA1:	2A679A391C810122DDD6A7EF722C35328FC09D9C
SHA-256:	537EA39AFBA7CFC059DE58D484EF450BEE73C7903D36F09A16CA983CB5B8F686
SHA-512:	85FEF0A89087D2196EC817A6444F9D94A8D315A64EAE9615C615DBB79B30320CED0D49A1A6C2CD566C722971FA8908A675B1C8F7E64D6875505C60400219F938
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Taipei)]} {. LoadTimeZoneFile Asia/Taipei.}.set TZData(:ROC) $TZData(:Asia/Taipei).

C:\ProgramData\assignee\tcl\tzdata\ROK

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.851755466867201
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8ZQckvFVAIgNtvQstlmFeWFKKQs:SlSWB9IZaM3yJmFVAIgztpwKg
MD5:	48E7BE02E802A47C0D2F87E633010F38
SHA1:	A547853A7ED03CE9C07FC3BAA0F57F5ABB4B636B
SHA-256:	2F362169FD628D6E0CB32507F69AD64177BC812E7E961E5A738F4F492B105128
SHA-512:	BCBE9BC1C08CFF97B09F8D566EC3B42B9CE8442FA4BECE37A18446CBBF0ECEDA66BA18ABFA5E52E7677B18FB5DABF00DF9E28DE17B094A690B097AFC7130EA89
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Seoul)]} {. LoadTimeZoneFile Asia/Seoul.}.set TZData(:ROK) $TZData(:Asia/Seoul).

C:\ProgramData\assignee\tcl\tzdata\Singapore

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.80663340464643
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq801cwFVAIgNtK1ERLkZ8O5h4WFKf1E:SlSWB9IZaM3yUpFVAIgWWLkth4wKfK
MD5:	9E2902F20F33CA25B142B6AA51D4D54F
SHA1:	C1933081F30ABB7780646576D7D0F54DC6F1BC51
SHA-256:	FCF394D598EC397E1FFEED5282874408D75A9C3FFB260C55EF00F30A80935CA4
SHA-512:	D56AF44C4E4D5D3E6FC31D56B9BA36BD8499683D1A3C9BC48EEE392C4AC5ACAA10E3E82282F5BDA9586AF26F4B6C0C5649C454399144F040CC94EA35BBB53B48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Singapore)]} {. LoadTimeZoneFile Asia/Singapore.}.set TZData(:Singapore) $TZData(:Asia/Singapore).

C:\ProgramData\assignee\tcl\tzdata\SystemV\AST4

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.951561086936219
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7p5oedVAIgppKNkjx+90pu:JBaIMYYpgN8+90M
MD5:	A1D42EC950DE9178058EAA95CCFBAA09
SHA1:	55BE1FAF85F0D5D5604685F9AC19286142FC7133
SHA-256:	888A93210241F6639FB9A1DB0519407047CB7F5955F0D5382F2A85C0C473D9A5
SHA-512:	3C6033D1C84B75871B8E37E71BFEE26549900C555D03F8EC20A31076319E2FEBB0240EC075C2CAFC948D629A32023281166A7C69AFEA3586DEE7A2F585CB5E82
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Puerto_Rico)]} {. LoadTimeZoneFile America/Puerto_Rico.}.set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico).

C:\ProgramData\assignee\tcl\tzdata\SystemV\AST4ADT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.900537547414888
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx02NEO4FVAIg202NEtYFkRDwh4IAcGE2NEOv:SlSNJB9IZaM3y7UEO4FVAIgpUEqFk+4b
MD5:	CFDB782F87A616B89203623B9D6E3DBF
SHA1:	1BB9F75215A172B25D3AE27AAAD6F1D74F837FE6
SHA-256:	62C72CF0A80A5821663EC5923B3F17C12CE5D6BE1E449874744463BF64BCC3D7
SHA-512:	085E5B6E81E65BC781B5BC635C6FA1E7BF5DC69295CF739C739F6361BF9EB67F36F7124A2D3E5ADA5F854149C84B9C8A7FB22E5C6E8FF57576EBDEA0E4D6560B
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax).

C:\ProgramData\assignee\tcl\tzdata\SystemV\CST6

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.911352504536709
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW6kR/eIAcGEsAzEun:SlSNJB9IZaM3y7hzipVAIgphzGCW6kcQ
MD5:	01215B5D234C433552A3BF0A440B38F6
SHA1:	B3A469977D38E1156B81A93D90E638693CFDBEEF
SHA-256:	2199E7DD20502C4AF25D57A58B11B16BA3173DB47EFA7AD2B33FDB72793C4DDB
SHA-512:	35D3BDE235FF40C563C7CEDD8A2CCBB4BAC2E2AA24A8E072EA0572BB231295D705EA9F84EEAA9FD2C735B1203332D8D97C3592A2B702BCFE9C81828D4F635205
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:SystemV/CST6) $TZData(:America/Regina).

C:\ProgramData\assignee\tcl\tzdata\SystemV\CST6CDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.929669998131187
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx096dVAIg2096zAtkRwx/h4IAcGE96s:SlSNJB9IZaM3y796dVAIgp96Wkyxp49c
MD5:	CDE40B5897D89E19A3F2241912B96826
SHA1:	00DE53DC7AA97F26B1A8BF83315635FBF634ABB3
SHA-256:	3C83D3DB23862D9CA221109975B414555809C27D45D1ED8B9456919F8BA3BF25
SHA-512:	69DFC06ACF544B7F95DEF2928C1DFE4D95FAD48EE753AD994921E1967F27A3AF891A9F31DDEA547E1BED81C5D2ECF5FC93E75019F2327DE1E73A009422BE52EC
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago).

C:\ProgramData\assignee\tcl\tzdata\SystemV\EST5

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.881715127736134
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y73G7mFVAIgp3GBLkkp4903G1:JBaIMY3G7Hp3GBLVp4903G1
MD5:	87FEA19F6D7D08F44F93870F7CBBD456
SHA1:	EB768ECB0B1B119560D2ACBB10017A8B3DC77FDD
SHA-256:	2B5887460D6FB393DED5273D1AA87A6A9E1F9E7196A8FA11B4DEB31FAD8922C8
SHA-512:	00DA47594E80D2DB6F2BE6E482A1140780B71F8BBE966987821249984627C5D8C31AA1F2F6251B4D5084C33C66C007A47AFF4F379FA5DA4A112BA028B982A85A
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indianapolis)]} {. LoadTimeZoneFile America/Indianapolis.}.set TZData(:SystemV/EST5) $TZData(:America/Indianapolis).

C:\ProgramData\assignee\tcl\tzdata\SystemV\EST5EDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.071686349792137
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0wAy0vwVAIg20wAyatkR5ghxEH/h4IAcGEwAy0v:SlSNJB9IZaM3y71KVAIgp1Bkrp4901h
MD5:	5C43C828D9460B9DF370F0D155B03A5C
SHA1:	92F92CD64937703D4829C42FE5656C7CCBA22F4E
SHA-256:	3F833E2C2E03EF1C3CC9E37B92DBFBA429E73449E288BEBE19302E23EB07C78B
SHA-512:	A88EAA9DAAD9AC622B75BC6C89EB44A2E4855261A2F7077D8D4018F00FC82E5E1EA364E3D1C08754701A545F5EC74752B9F3657BF589CF76E5A3931F81E99BBF
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:SystemV/EST5EDT) $TZData(:America/New_York).

C:\ProgramData\assignee\tcl\tzdata\SystemV\HST10

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.927529755640769
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNkRSm1hpUDH2fWRn:SlSNJB9IZaM3yc6e8dVAIgOb6ezvNkQN
MD5:	1A50997B6F22E36D2E1849D1D95D0882
SHA1:	F4AC3ABBEA4A67013F4DC52A04616152C4C639A9
SHA-256:	C94C64BF06FDE0A88F24C435A52BDDE0C5C70F383CD09C62D7E42EAB2C54DD2C
SHA-512:	CCBD66449983844B3DB440442892004D070E5F0DFF454B25C681E13EB2F25F6359D0221CE5FF7800AC794A32D4474FE1126EA2465DB83707FF7496A1B39E6E1A
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu).

C:\ProgramData\assignee\tcl\tzdata\SystemV\MST7

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.953801751537501
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtkRgFfh4IAcGEutLNn:SlSNJB9IZaM3y7O+FVAIgpObtkch490u
MD5:	2B415F2251BE08F1035962CE2A04149F
SHA1:	EFF5CE7CD0A0CBCF366AC531D168CCB2B7C46734
SHA-256:	569819420F44D127693C6E536CAC77410D751A331268D0C059A1898C0E219CF4
SHA-512:	971F1763558D8AC17753C01B7BB64E947C448AA29951064ED7C5997D4B4A652C7F5D7C2CB4F8040F73AD83D7E49B491B93047A06D8C699F33B08F4A064BE0DCC
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:SystemV/MST7) $TZData(:America/Phoenix).

C:\ProgramData\assignee\tcl\tzdata\SystemV\MST7MDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.909831110037175
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx06RGFwVAIg206RAO0LkRMMFfh4IAcGE6Ru:SlSNJB9IZaM3y7+SwVAIgp+iLkD490+u
MD5:	895E9BAF5EDF0928D4962C3E6650D843
SHA1:	52513BFA267CA2E84FDDF3C252A4E8FD059F2847
SHA-256:	465A4DE93F2B103981A54827CDEBB10350A385515BB8648D493FD376AABD40AF
SHA-512:	CAF19320F0F507160E024C37E26987A99F2276622F2A6D8D1B7E3068E5459960840F4202FF8A98738B9BCA0F42451304FC136CBD36BBFE39F616622217AD89A3
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:SystemV/MST7MDT) $TZData(:America/Denver).

C:\ProgramData\assignee\tcl\tzdata\SystemV\PST8

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.782387645904801
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQGuQTWLM4YkvFVAIgObTuQTWLvqtkRQB5nUDHuQTWi:SlSNJB9IZaM3yciQyLM4YmFVAIgObiQq
MD5:	67AE3FD76B2202F3B1CF0BBC664DE8D0
SHA1:	4603DE0753B684A8D7ACB78A6164D5686542EE8E
SHA-256:	30B3FC95A7CB0A6AC586BADF47E9EFA4498995C58B80A03DA2F1F3E8A2F3553B
SHA-512:	BF45D0CA674DD631D3E8442DFB333812B5B31DE61576B8BE33B94E0433936BC1CD568D9FC522C84551E770660BE2A98F45FE3DB4B6577968DF57071795B53AD9
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pitcairn)]} {. LoadTimeZoneFile Pacific/Pitcairn.}.set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn).

C:\ProgramData\assignee\tcl\tzdata\SystemV\PST8PDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.959254419324467
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7DvwFVAIgpdJLkQ1p490Dvn:JBaIMYFpdJLh090z
MD5:	DFB48E0E2CE5D55DC60B3E95B7D12813
SHA1:	535E0BF050E41DCFCE08686AFDFAFF9AAFEF220C
SHA-256:	74096A41C38F6E0641934C84563277EBA33C5159C7C564C7FF316D050083DD6D
SHA-512:	3ECDF3950ED3FB3123D6C1389A2A877842B90F677873A0C106C4CA6B180EEC38A26C74E21E8A3036DA8980FF7CA9E1578B0E1D1A3EA364A4175772F468747425
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles).

C:\ProgramData\assignee\tcl\tzdata\SystemV\YST9

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.905971098884841
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQG5hB5pVAIgObT5hBiLkRKlUDH5hBun:SlSNJB9IZaM3ycTpVAIgOb4LkK
MD5:	CED0A343EF3A316902A10467B2F66B9B
SHA1:	5884E6BA28FD71A944CA2ED9CB118B9E108EF7CB
SHA-256:	1BB5A98B80989539135EAB3885BBA20B1E113C19CB664FB2DA6B150DD1F44F68
SHA-512:	903D1DC6D1E192D4A98B84247037AE171804D250BB5CB84D2C5E145A0BDC50FCD543B70BAFF8440AFF59DA14084C8CEEFB2F912A02B36B7571B0EEEC154983B3
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Gambier)]} {. LoadTimeZoneFile Pacific/Gambier.}.set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier).

C:\ProgramData\assignee\tcl\tzdata\SystemV\YST9YDT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.949109665596263
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7/9EtDvFVAIgp/9EmLkB490/9E6:JBaIMY/944p/9xLN90/9F
MD5:	D588930E34CF0A03EFEE7BFBC5022BC3
SHA1:	0714C6ECAAF7B4D23272443E5E401CE141735E78
SHA-256:	4D1CAE3C453090667549AB83A8DE6F9B654AAC5F540192886E5756A01D21A253
SHA-512:	ABE69BEF808D7B0BEF9F49804D4A753E033D7C99A7EA57745FE4C3CBE2C26114A8845A219ED6DEAB8FA009FDB86E384687068C1BCF8B704CCF24DA7029455802
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage).

C:\ProgramData\assignee\tcl\tzdata\Turkey

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.882090609090058
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHtjCl1yQaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHtSymN
MD5:	41703ED241199F0588E1FC6FF0F33E90
SHA1:	08B4785E21E21DFE333766A7198C325CD062347B
SHA-256:	4B8A8CE69EE94D7E1D49A2E00E2944675B66BD16302FE90E9020845767B0509B
SHA-512:	F90F6B0002274AF57B2749262E1530E21906162E4D1F3BE89639B5449269F3026A7F710C24765E913BC23DEC5A6BF97FC0DD465972892D851B6EAEEF025846CA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Turkey) $TZData(:Europe/Istanbul).

C:\ProgramData\assignee\tcl\tzdata\UCT

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.792993822845485
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAmMwFVAIghO6iGMFfh8RS:SlSWB9IZaM3y1wFVAIghFiP8RS
MD5:	1921CC58408AD2D7ED3B5308C71B1A28
SHA1:	12F832D7B3682DC28A49481B8FBA8C55DCDC60D0
SHA-256:	92FC6E3AA418F94C486CE5BF6861FAA4E85047189E98B90DA78D814810E88CE7
SHA-512:	EB134E2E7F7A811BFA8223EB4E98A94905EA24891FD95AB29B52DE2F683C97E086AA2F7B2EA93FBA2451AAEDD22F01219D700812DABC7D6670028ACF9AAB8367
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UCT)]} {. LoadTimeZoneFile Etc/UCT.}.set TZData(:UCT) $TZData(:Etc/UCT).

C:\ProgramData\assignee\tcl\tzdata\US\Alaska

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.864166947846424
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/VXEtDvFVAIg20/VXE0JLiOGl0IAcGE/VXE6n:SlSWB9IZaM3y7/9EtDvFVAIgp/9EmLiB
MD5:	0763082FF8721616592350D8372D59FF
SHA1:	CEBB03EB7F44530CF52DCA7D55DC912015604D94
SHA-256:	94FDFE2901596FC5DCE74A5560431F3E777AE1EBEEE59712393AE2323F17ADFA
SHA-512:	DFE8AAA009C28C209A925BBE5509589C0087F6CC78F94763BFA9F1F311427E3FF2E377EB340590383D790D3578C1BB37D41525408D027763EA96ECB3A3AAD65D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:US/Alaska) $TZData(:America/Anchorage).

C:\ProgramData\assignee\tcl\tzdata\US\Aleutian

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.839824852896375
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvtiObMEIB/4IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9FitE8/47
MD5:	01142938A2E5F30FADE20294C829C116
SHA1:	8F9317E0D3836AF916ED5530176C2BF7A929C3C7
SHA-256:	1DD79263FB253217C36A9E7DDCB2B3F35F208E2CE812DCDE5FD924593472E4FE
SHA-512:	2C47FE8E8ED0833F4724EF353A9A6DFCE3B6614DA744E64364E9AB423EC92565FEF1E8940CB12A0BCCFE0BD6B44583AF230A4ABCC0BAE3D9DC43FBB2C7941CFF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:US/Aleutian) $TZData(:America/Adak).

C:\ProgramData\assignee\tcl\tzdata\US\Arizona

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.886225611026426
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtiQMfQfBx+IAcGEutLNn:SlSWB9IZaM3y7O+FVAIgpObtiZfQfH+v
MD5:	090DC30F7914D5A5B0033586F3158384
SHA1:	2F526A63A1C47F88E320BE1C12CA8887DA2DC989
SHA-256:	47D25266ABBD752D61903C903ED3E9CB485A7C01BD2AA354C5B50DEBC253E01A
SHA-512:	5FE75328595B5DECDAC8D318BEE89EAD744A881898A4B45DD2ABB5344B13D8AFB180E4A8F8D098A9589488D9379B0153CBC5CF638AF7011DE89C57B554F42757
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:US/Arizona) $TZData(:America/Phoenix).

C:\ProgramData\assignee\tcl\tzdata\US\Central

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.854450230853601
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx096dVAIg2096zAtibXgox/h4IAcGE96s:SlSWB9IZaM3y796dVAIgp96WiB49096s
MD5:	E0801B5A57F40D42E8AF6D48C2A41467
SHA1:	A49456A1BF1B73C6B284E0764AEAFD1464E70DDC
SHA-256:	16C7FFCE60495E5B0CB65D6D5A0C3C5AA9E62BD6BC067ABD3CD0F691DA41C952
SHA-512:	3DE6A41B88D6485FD1DED2DB9AB9DAD87B9F9F95AA929D38BF6498FC0FD76A1048CE1B68F24CD22C487073F59BD955AFCB9B7BF3B20090F81FA250A5E7674A53
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:US/Central) $TZData(:America/Chicago).

C:\ProgramData\assignee\tcl\tzdata\US\East-Indiana

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.715837665658945
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBLi3E0903GK1:MBaIMY3GK7Hp3GKBLi3t903GK1
MD5:	1A27644D1BF2299B7CDDED7F405D6570
SHA1:	BD03290A6E7A967152E2E4F95A82E01E7C35F63C
SHA-256:	1C46FAEDFACEB862B2E4D5BD6AC63E5182E1E2CFD2E1CDFA2661D698CC8B0072
SHA-512:	9D6F3E945656DD97A7E956886C1123B298A87704D4F5671E4D1E94531C01F8BE377D83239D8BE78E2B3E1C0C20E5779BA3978F817A6982FE607A18A7FDCF57FB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis).

C:\ProgramData\assignee\tcl\tzdata\US\Eastern

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.990255962392122
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0wAy0vwVAIg20wAyati37oxp4IAcGEwAy0v:SlSWB9IZaM3y71KVAIgp1Bi37oxp490n
MD5:	3FE03D768F8E535506D92A6BC3C03FD2
SHA1:	F82BF149CE203B5A4A1E106A495D3409AF7A07AC
SHA-256:	9F46C0E46F6FE26719E2CF1FA05C7646530B65FB17D4101258D357568C489D77
SHA-512:	ADFDBB270113A192B2378CC347DD8A57FDBDC776B06F9E16033EE8D5EAB49E16234CA2523580EEBB4DCDD27F33222EDD5514F0D7D85723597F059C5D6131E1B0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:US/Eastern) $TZData(:America/New_York).

C:\ProgramData\assignee\tcl\tzdata\US\Hawaii

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.832149382727646
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNioMN75nUDH2fWRn:SlSWB9IZaM3yc6e8dVAIgOb6ezvNioEe
MD5:	347E51049A05224D18F264D08F360CBB
SHA1:	A801725A9B01B5E08C63BD2568C8F5D084F0EB02
SHA-256:	EA5D18E4A7505406D6027AD34395297BCF5E3290283C7CC28B4A34DB8AFBDD97
SHA-512:	C9B96C005D90DD8F317A697F59393D20663DE74D6E4D0B45BCE109B31A328D7AA62C51FAA8D00C728C0342940EF3B0F0921814B31BD7FE128A6E95F92CF50E06
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu).

C:\ProgramData\assignee\tcl\tzdata\US\Indiana-Starke

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.825742972037525
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GKXFVAIgp3GK4NiGIfh4903GKk:MBaIMY3GKXQp3GKeiBfh4903GKk
MD5:	E111813F4C9B888427B8363949C87C72
SHA1:	96B6692DCD932DCC856804BE0C2145538C4B2B33
SHA-256:	4E896634F3A400786BBD996D1FE0D5C9A346E337027B240F1671A7E4B38C8F69
SHA-512:	97726D7EDB7D7A1F6E815A0B875CAF9E2D2D27F50ECC866FBC6CB1B88836E8C2D64A9C108CD917C9D641B30822397664A2AC8010EADF0FF2A6C205AE4D5E7A2F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox).

C:\ProgramData\assignee\tcl\tzdata\US\Michigan

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.7846496799669405
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06FQGFwVAIg206FQN6iHaMCELMr4IAcGE6FQu:SlSWB9IZaM3y74PFwVAIgp4xiHaMHL+U
MD5:	80A9A00EC1C5904A67DC3E8B2FDC3150
SHA1:	8E79FBEB49D9620E793E4976D0B9085E32C57E83
SHA-256:	8DB76FC871DD334DA87297660B145F8692AD053B352A19C2EFCD74AF923D762D
SHA-512:	0A5662E33C60030265ECAD1FF683B18F6B99543CA5FE22F88BCE597702FBEA20358BCB9A568D7F8B32158D9E6A3D294081D183644AD49C22AC3512F97BE480D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Detroit)]} {. LoadTimeZoneFile America/Detroit.}.set TZData(:US/Michigan) $TZData(:America/Detroit).

C:\ProgramData\assignee\tcl\tzdata\US\Mountain

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.84430947557215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0LiBOlLo/4IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLiBY8/49G
MD5:	13D6C7CF459995691E37741ACAF0A18D
SHA1:	A0626763930C282DF21ED3AA8F1B35033BA2F9DC
SHA-256:	223B5C8E34F459D7B221B83C45DBB2827ABE376653BAA1BC56D09D50DF136B08
SHA-512:	9076DFECC5D02DB38ECE3D2512D52566675D98A857711676E891D8741EA588153954357FE19F4C69305FF05D0F99286F1D496DF0C7FDBC8D59803D1B1CFA5F07
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:US/Mountain) $TZData(:America/Denver).

C:\ProgramData\assignee\tcl\tzdata\US\Pacific

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.885594237758327
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0ydJg4owFVAIg20ydJEvRLiP+e2IAcGEydJgvn:SlSWB9IZaM3y7DvwFVAIgpdJLip290Dv
MD5:	EBF51CD015BD387FA2BB30DE8806BDDA
SHA1:	63C2E2F4CD8BC719A06D59EF4CE4C31F17F53EA0
SHA-256:	B7AD78FB955E267C0D75B5F7279071EE17B6DD2842DAD61ADA0165129ADE6A86
SHA-512:	22BECE2AEAD66D921F38B04FDC5A41F2627FCC532A171EA1C9C9457C22CD79EFD1EC3C7CC62BC016751208AD1D064B0F03C2185F096982F73740D8426495F5ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific) $TZData(:America/Los_Angeles).

C:\ProgramData\assignee\tcl\tzdata\US\Pacific-New

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.931883193402467
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7DvwFVAIgpdJLi0Q90Dvn:MBaIMYFpdJLix90z
MD5:	01CD3EBFDB7715805572CDA3F81AC78A
SHA1:	C013C38D2FB9E649EE43FED6910382150C2B3DF5
SHA-256:	DEFE67C520303EF85B381EBEAED4511C0ACF8C49922519023C525E6A1B09B9DD
SHA-512:	266F35C34001CD4FF00F51F5CDF05E1F4D0B037F276EFD2D124C8AE3391D00128416D16D886B3ECDF9E9EFC81C66B2FD4ED55F154437ED5AA32876B855289190
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific-New) $TZData(:America/Los_Angeles).

C:\ProgramData\assignee\tcl\tzdata\US\Samoa

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.789322986138067
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAti6A5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiidXeg
MD5:	E883D478518F6DAF8173361A8D308D34
SHA1:	ABD97858655B0069BFD5E11DD95BF6D7C2109AEA
SHA-256:	DD4B1812A309F90ABBD001C3C73CC2AF1D4116128787DE961453CCBE53EC9B6A
SHA-512:	DA1FE6D92424404111CBB18CA39C8E29FA1F9D2FD262D46231FB7A1A78D79D00F92F5D1DEBB9B92565D1E3BA03EF20D2A44B76BA0FC8B257A601EED5976386CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago).

C:\ProgramData\assignee\tcl\tzdata\UTC

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.792993822845485
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiLB5h8RFu:SlSWB9IZaM3yzUFVAIgBLiLfh8RI
MD5:	530F5381F9CD8542ED5690E47FC83358
SHA1:	29A065F004F23A5E3606C2DB50DC0AB28CAFC785
SHA-256:	AC0FF734DA267E5F20AB573DBD8C0BD7613B84D86FDA3C0809832F848E142BC8
SHA-512:	4328BDFD6AA935FD539EE2D4A3EBA8DD2A1BD9F44BA0CF30AA0C4EA57B0A58E3CDFAA312366A0F93766AE445E6E210EE57CD5ED60F74173EDF67C1C5CB987C68
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:UTC) $TZData(:Etc/UTC).

C:\ProgramData\assignee\tcl\tzdata\Universal

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.829496870339919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiL7DJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLiL7VMr8RI
MD5:	60878BB8E8BE290911CAB2A16AAFAEF7
SHA1:	15C01523EDA134D3E38ECC0A5909A4579BD2A00D
SHA-256:	9324B6C871AC55771C44B82BF4A92AE0BE3B2CC64EBA9FE878571225FD38F818
SHA-512:	C697401F1C979F5A4D33E1026DCE5C77603E56A48405511A09D8CE178F1BF47D60F217E7897061F71CFEA63CC041E64340EF6BAEE0EB037AFD34C71BF0591E3E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Universal) $TZData(:Etc/UTC).

C:\ProgramData\assignee\tcl\tzdata\W-SU

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.9534620854837295
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVwTwpVAIgoqzTcYFgIuyQauTnn:SlSWB9IZaM3ymdVAIgohYFgXymn
MD5:	58FBF79D86DBCFF53F74BF7FE5C12DD6
SHA1:	EA8B3317B012A661B3BA4A1FAE0DC5DEDC03BC26
SHA-256:	0DECFEACCE2E2D88C29CB696E7974F89A687084B3DB9564CDED6FC97BCD74E1F
SHA-512:	083B449DE987A634F7199666F9C685EADD643C2C2DD9C8F6C188388266729CE0179F9DC0CD432D713E5FB1649D0AA1A066FE616FC43DA65C4CD787D8E0DE00A6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Moscow)]} {. LoadTimeZoneFile Europe/Moscow.}.set TZData(:W-SU) $TZData(:Europe/Moscow).

C:\ProgramData\assignee\tcl\tzdata\WET

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6694
Entropy (8bit):	3.6896780927557495
Encrypted:	false
SSDEEP:	96:D6U5vo30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:5PIMj544IrvfMsbxZTH7qwQ
MD5:	CD86A6ED164FEB33535D74DF52DC49A5
SHA1:	89843BF23AB113847DCC576990A4FF2CABCA03FE
SHA-256:	AF28754C77BA41712E9C49EF3C9E08F7D43812E3317AD4E2192E971AD2C9B02D
SHA-512:	80C0A7C3BDD458CA4C1505B2144A3AD969F7B2F2732CCBE4E773FBB6ED446C2961E0B5AFFBC124D43CE9AB530C42C8AEC7100E7817566629CE9D01AC057E3549
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:WET) {. {-9223372036854775808 0 0 WET}. {228877200 3600 1 WEST}. {243997200 0 0 WET}. {260326800 3600 1 WEST}. {276051600 0 0 WET}. {291776400 3600 1 WEST}. {307501200 0 0 WET}. {323830800 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 36

C:\ProgramData\assignee\tcl\tzdata\Zulu

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.830292555237936
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLtaFBURFu:SlSWB9IZaM3yzUFVAIgBLYFaRI
MD5:	6C7C2CE174DB462A3E66D9A8B67A28EB
SHA1:	73B74BEBCDAEBDA4F46748BCA149BC4C7FE82722
SHA-256:	4472453E5346AAA1E1D4E22B87FDC5F3170AA013F894546087D0DC96D4B6EC43
SHA-512:	07209059E5E5EB5EE12821C1AC46922DA2715EB7D7196A478F0FA6866594D3C69F4C50006B0EE517CBF6DB07164915F976398EBBD88717A070D750D5D106BA5D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Zulu) $TZData(:Etc/UTC).

C:\ProgramData\assignee\tcl\word.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.7695981796995355
Encrypted:	false
SSDEEP:	96:Le+U54W3Jp3jgr9a+1FeS9D/CkXg6gvF9D/CYjX16AyyrGuA11/JRJ6xMa89RJ6m:q+W/ga+P39DCd6gt9DC+6AjG9Vn6xMV3
MD5:	DE79F133B24EFA0AD1A8CB0B1F90210F
SHA1:	3C7133228F078C3EB2FBDC05481226FF7D82F40D
SHA-256:	64585C5327B0710D31BFF61C14564FF289ACAAD8743174F95544D8C04306D8C7
SHA-512:	E6F515139B980EDD420E0CD2883146C3C3F472381C8F55E65284CF50AE7D87EFF20B775D539A5FE7F0007DE52DC50F351464F988FE956E916B767D2629D897F9
Malicious:	false
Preview:	# word.tcl --.#.# This file defines various procedures for computing word boundaries in.# strings. This file is primarily needed so Tk text and entry widgets behave.# properly for different platforms..#.# Copyright (c) 1996 by Sun Microsystems, Inc..# Copyright (c) 1998 by Scritpics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# The following variables are used to determine which characters are.# interpreted as white space...if {$::tcl_platform(platform) eq "windows"} {. # Windows style - any but a unicode space char. set ::tcl_wordchars {\S}. set ::tcl_nonwordchars {\s}.} else {. # Motif style - any unicode word char (number, letter, or underscore). set ::tcl_wordchars {\w}. set ::tcl_nonwordchars {\W}.}..# Arrange for caches of the real matcher REs to be kept, which enables the REs.# themselves to be cached for greater performance (and somewhat greater.# clarity too

C:\ProgramData\assignee\tk86t.dll

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1478144
Entropy (8bit):	6.235246427646989
Encrypted:	false
SSDEEP:	24576:BwcMqY1Nw/Lv4KWdY8nxjNedq6PNPgaCzzqpblrI9YNyVbQwYEZB2Bvb:Wfw4Kd8lNzqP/C8rIWNE0lEZB2
MD5:	8DE9DB5308DF0941CC095F023255FF8D
SHA1:	58DF6DAAFBDE363066CDCC29663B7B2C5F927097
SHA-256:	8A1BB5FDC3C40B431FFE645609807D77F8F029A96CBB366241C6CB28DE27C605
SHA-512:	B2A2C891DFFFB46A6B9F787EAC4A2750FB2541755590FB4CB495864D8C799FFBAFEAC602A5577A7FA406CDB232DC70BB1C56092919D0F8CE58CA3BB4B56C5679
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(k..(k..(k.^...(k.^...(k.^...(k.^...(k..P...(k..P...(k..(j.)k.^..D(k.^...(k.^...(k.^...(k.Rich.(k.................PE..L...:#.R...........!.....h...0....................".......................................@.........................P...x?...r.......`..Xx..........................................................(q..@...............(............................text....f.......h.................. ..`.rdata...K.......L...l..............@..@.data...p........v..................@....rsrc...Xx...`...z..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\tk\bgerror.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8259
Entropy (8bit):	4.8186846403663575
Encrypted:	false
SSDEEP:	192:tKrjbDL5//nNFn0rBnDQQ2d4YGpF9ImoYyMxZ34wNsf9GnEF5SpcJV+H//iNx:tIjL5//zC/hHLx4XKKv
MD5:	01229C40D2B1F2166F5720565CC51065
SHA1:	E92E62685CB983F864AE38E2FF6D5EEC77CB60DE
SHA-256:	96766B3C324AF2CA64A3AD7034B92048EF6252974298885A7770697511498A12
SHA-512:	1BB4770397B973A206B2E21376BBE645E759EB06B91718FB83E6F34BFCEAF4D8BCA51BAD4885ABCDDC0B894A726E5A1A27FB04DD99F1937D4982975ACFA38BD0
Malicious:	false
Preview:	# bgerror.tcl --.#.#.Implementation of the bgerror procedure. It posts a dialog box with.#.the error message and gives the user a chance to see a more detailed.#.stack trace, and possible do something more interesting with that.#.trace (like save it to a log). This is adapted from work done by.#.Donal K. Fellows..#.# Copyright (c) 1998-2000 by Ajuba Solutions..# Copyright (c) 2007 by ActiveState Software Inc..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>..namespace eval ::tk::dialog::error {. namespace import -force ::tk::msgcat::. namespace export bgerror. option add ErrorDialog.function.text [mc "Save To Log"] \..widgetDefault. option add ErrorDialog.function.command [namespace code SaveToLog]. option add ErrorDialogLabel.font TkCaptionFont widgetDefault. if {[tk windowingsystem] eq "aqua"} {..option add ErrorDialog*background systemAlertBackgroundActive \...widgetDefault.

C:\ProgramData\assignee\tk\button.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20200
Entropy (8bit):	4.905094736122802
Encrypted:	false
SSDEEP:	384:EzRtoY3wFnq+j4SpEdPmVmZ6/IVKuzmSaox2ESo+VtocUP5wFnq+j4SpEdPmV8Zo:GoahPSFMmfoz4oFXhPovzmToQBy0zm2u
MD5:	F4E86150F27B0C8556966EEA2BCFA790
SHA1:	1DBB8E13AFF4232FF5F1A4EE1C881C12E28A61CD
SHA-256:	3E35E90EBE12829FC5766AEDA07BEAA230647DA592CFEB3F5FD018C2E1892E78
SHA-512:	929E304E3AFDD8F2258860E71BF6F205322F29A58550D025A491A569C01DB8776C099E6C340991C93A361853BBE72B408277684FE7659BAEB274293617848635
Malicious:	false
Preview:	# button.tcl --.#.# This file defines the default bindings for Tk label, button,.# checkbutton, and radiobutton widgets and provides procedures.# that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 2002 ActiveState Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for buttons..#-------------------------------------------------------------------------..if {[tk windowingsystem] eq "aqua"} {. bind Radiobutton <Enter> {..tk::ButtonEnter %W. }. bind Radiobutton <1> {..tk::ButtonDown %W. }. bind Radiobutton <ButtonRelease-1> {..tk::ButtonUp %W. }. bind Checkbutton <Enter> {..tk::ButtonEnter %W. }. bind Checkbutton <1>

C:\ProgramData\assignee\tk\choosedir.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Nim source code, ASCII text
Category:	dropped
Size (bytes):	9660
Entropy (8bit):	4.748575983009093
Encrypted:	false
SSDEEP:	192:MvjK3vpIKU7JBhpZofNAieYemp8U3wNV97oZAWpopePXUstcWjocIegf6tq9jJKM:M4viKeBQ+3M3wNwfwsFioIegf6wO70fN
MD5:	4CCC4D7992439F527A4EBAFE1B70CB0F
SHA1:	364F654085B03A9B77A3371C85C35B605D5B9F0D
SHA-256:	8F8E68D3B5BDEB53B0AB7968C842E430DCFD00A5BF0215DB22E93A4A68439D70
SHA-512:	A46E3E316211D4FDB3C62BCDCE58A2DA9B1E7F74A8797995B31D7EAC52DA872DC7144917813ADCF43CF110487C886701DDAD73178697BD90766A4E8D40D6F546
Malicious:	false
Preview:	# choosedir.tcl --.#.#.Choose directory dialog implementation for Unix/Mac..#.# Copyright (c) 1998-2000 by Scriptics Corporation..# All rights reserved...# Make sure the tk::dialog namespace, in which all dialogs should live, exists.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}..# Make the chooseDir namespace inside the dialog namespace.namespace eval ::tk::dialog::file::chooseDir {. namespace import -force ::tk::msgcat::*.}..# ::tk::dialog::file::chooseDir:: --.#.#.Implements the TK directory selection dialog..#.# Arguments:.#.args..Options parsed by the procedure..#.proc ::tk::dialog::file::chooseDir:: {args} {. variable ::tk::Priv. set dataName __tk_choosedir. upvar ::tk::dialog::file::$dataName data. Config $dataName $args.. if {$data(-parent) eq "."} {. set w .$dataName. } else {. set w $data(-parent).$dataName. }.. # (re)create the dialog box if necessary. #. if {![winfo exists $w]} {..::tk::dialog::file::Create

C:\ProgramData\assignee\tk\clrpick.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21446
Entropy (8bit):	4.986197381438281
Encrypted:	false
SSDEEP:	384:HjJsgeqJelEc661T26UYdTVDyPHxQlefbGIjVjrdOqAQBxhKN2zD5yT9RmqEdFC6:DagJJlBfxQEHN
MD5:	1CA2F8B7473F7268F372AAAE12FDDAA6
SHA1:	CE307C63746DF6CB239A241D3B7FC139F11F8010
SHA-256:	63E8ED58F6C2AC904128FFEDB0FE596FB7657858162A91D1945412F41D19FD8F
SHA-512:	E599A4B532A5B6EAA85D72A88BDE001020809128E4664C5C26BBA941CDBE4C544CA0C824A9F77B8D8002AFD5454D234CF8C2E4D3C73EAB624BC4CF0052143465
Malicious:	false
Preview:	# clrpick.tcl --.#.#.Color selection dialog for platforms that do not support a.#.standard color selection dialog..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# ToDo:.#.#.(1): Find out how many free colors are left in the colormap and.#. don't allocate too many colors..#.(2): Implement HSV color selection. .#..# Make sure namespaces exist.namespace eval ::tk {}.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::color {. namespace import ::tk::msgcat::*.}..# ::tk::dialog::color:: --.#.#.Create a color dialog and let the user choose a color. This function.#.should not be called directly. It is called by the tk_chooseColor.#.function when a native color selector widget does not exist.#.proc ::tk::dialog::color:: {args} {. variable ::tk::Priv. set dataName __tk__color. upvar ::tk::dialog::color::$dataName data. set w .$dataName

C:\ProgramData\assignee\tk\comdlg.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8232
Entropy (8bit):	5.053527634658779
Encrypted:	false
SSDEEP:	192:Aq7cPy5HEOjKU8QHyWpSWNRYs50asAZbQWlO+W0WvHv/3WvWHwV7nKpTTk:Aq7c6HJjKCyWpZNRYEVVST1rvveuHSnT
MD5:	DD0D62F2CAFC6FF87A5A8AADB429B7CC
SHA1:	B07A6F4F09C572B7B9901EF7B6DF56889A003445
SHA-256:	036AF26707E69F597D85B6398A7A1B1EA163CEBF27F4BD4B30C414068DC3B765
SHA-512:	E7FF2E0D5CAB21D2CCF3A60A1DAE255D03B50A9E8C3EBCF6541DD231F4C9F674B0A6FA69330250E9A1FF11CC2BBAE1D0F7E9D4F43798B9AC2A009A6909DFCC97
Malicious:	false
Preview:	# comdlg.tcl --.#.#.Some functions needed for the common dialog boxes. Probably need to go.#.in a different file..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# tclParseConfigSpec --.#.#.Parses a list of "-option value" pairs. If all options and.#.values are legal, the values are stored in.#.$data($option). Otherwise an error message is returned. When.#.an error happens, the data() array may have been partially.#.modified, but all the modified members of the data(0 array are.#.guaranteed to have valid values. This is different than.#.Tk_ConfigureWidget() which does not modify the value of a.#.widget record if any error occurs..#.# Arguments:.#.# w = widget record to modify. Must be the pathname of a widget..#.# specs = {.# {-commandlineswitch resourceName ResourceClass defaultValue verifier}.# {....}.# }.#.# flags = currently unused..#.# argList

C:\ProgramData\assignee\tk\console.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	32061
Entropy (8bit):	4.91174549503503
Encrypted:	false
SSDEEP:	384:GkptO+PjWz4xOtyU/W1ZQWiVEwYGl7nS5J+ry3buQlLW44qvRHTrStCO2FfB2SW4:Gkp0eWz4niTeG6J+r7YX6GZWFOYoV
MD5:	804C1FAAFE394FCD1166B60E02E9068A
SHA1:	C2240D0B66ED85453A4685C747F7AD5B5DC8FF04
SHA-256:	D38000624766B73447190C4F06B5984E6D028BE5BBA68F7FB067EE38D5BE3803
SHA-512:	E84F5623E695D66F15D49B0529D3014464A6218A2FD5FF3889F305BCA7899E137F6F030930FF2152E7767506E857C4EE5C28252F4BBA397C2D53C16575A04757
Malicious:	false
Preview:	# console.tcl --.#.# This code constructs the console window for an application. It.# can be used by non-unix systems that do not have built-in support.# for shells..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..# Copyright (c) 2007-2008 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# TODO: history - remember partially written command..namespace eval ::tk::console {. variable blinkTime 500 ; # msecs to blink braced range for. variable blinkRange 1 ; # enable blinking of the entire braced range. variable magicKeys 1 ; # enable brace matching and proc/var recognition. variable maxLines 600 ; # maximum # of lines buffered in console. variable showMatches 1 ; # show multiple expand matches. variable useFontchooser [llength [info command ::tk::fontchooser]]. variable inPlugi

C:\ProgramData\assignee\tk\dialog.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6050
Entropy (8bit):	4.7949260834936505
Encrypted:	false
SSDEEP:	96:WfPgCAV8OgciKHKKcmQH+DmlYm4Kapo9mBy//IWxIb:WfPgCAVviKHKK4H+DmT4Kapo4ynDOb
MD5:	17E2E453D8675C4FCD8CCAF544D297C4
SHA1:	31DEB1E48CB3CAC66DD3935FA19A49DCF9E95ED7
SHA-256:	294B0453FDDF54D30F956354EC50864E935366BF439172F357D502E331EA53EB
SHA-512:	62F0E1E230CB28D27731F291DB1698E9AD24B464E715714F686ACF8EA4FF1022DE6A3FCD3DD9DD2FB959079328B56C19204C45857CFCB9C3CB75A79488D73E5D
Malicious:	false
Preview:	# dialog.tcl --.#.# This file defines the procedure tk_dialog, which creates a dialog.# box containing a bitmap, a message, and one or more buttons..#.# Copyright (c) 1992-1993 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#.# ::tk_dialog:.#.# This procedure displays a dialog box, waits for a button in the dialog.# to be invoked, then returns the index of the selected button. If the.# dialog somehow gets destroyed, -1 is returned..#.# Arguments:.# w -..Window to use for dialog top-level..# title -.Title to display in dialog's decorative frame..# text -.Message to display in dialog..# bitmap -.Bitmap to display in dialog (empty string means none)..# default -.Index of button that is to display the default ring.#..(-1 means none)..# args -.One or more strings to display in buttons across the.#..bottom of t

C:\ProgramData\assignee\tk\entry.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16779
Entropy (8bit):	4.932265805040821
Encrypted:	false
SSDEEP:	384:PXeFkH2gRhOMQod3tCAERebMIDlXVQgXwVviw:POFDeUy8V
MD5:	D3B086BE7499626FCB421EDFB4074045
SHA1:	82AA1B6B106669C1A9277BB752AEECC6EF116CB0
SHA-256:	3CF4BD444368F938DB9337F9F2156425976DBA7B4A9EEBEFFDEFFA9C025D76AC
SHA-512:	27A058F0FE7A100788A14393A79F63DC162ADFFBD04F9C8034C99FF00BF129415C9381D43ACE2C21671533006C7C50BD646F13CE70CA530785499AE9ADF39E7F
Malicious:	false
Preview:	# entry.tcl --.#.# This file defines the default bindings for Tk entry widgets and provides.# procedures that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a selection)..# pressX -..X-coordinate at which the mouse button was pressed..# selectMode -..The style of selection currently underway:.#...char, word, or line..# x, y -..La

C:\ProgramData\assignee\tk\focus.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4857
Entropy (8bit):	4.7675047842795895
Encrypted:	false
SSDEEP:	96:mumhRUI7F2WyHm6BUyNhEf6jUHKRUI7F2WyQe6L763AcnK0/61sk2ko5AgEplauw:ERUQFU52CNRUQFpLOQIG1sk2TCLplauw
MD5:	7EA007F00BF194722FF144BE274C2176
SHA1:	6835A515E85A9E55D5A27073DAE1F1A5D7424513
SHA-256:	40D4E101A64B75361F763479B01207AE71535337E79CE6E162265842F6471EED
SHA-512:	E2520EB065296C431C71DBBD5503709CF61F93E74FE324F4F8F3FE13131D62435B1E124D38E2EC84939B92198A54B8A71DFC0A8D32F0DD94139C54068FBCAAF2
Malicious:	false
Preview:	# focus.tcl --.#.# This file defines several procedures for managing the input.# focus..#.# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_focusNext --.# This procedure returns the name of the next window after "w" in.# "focus order" (the window that should receive the focus next if.# Tab is typed in w). "Next" is defined by a pre-order search.# of a top-level and its non-top-level descendants, with the stacking.# order determining the order of siblings. The "-takefocus" options.# on windows determine whether or not they should be skipped..#.# Arguments:.# w -..Name of a window...proc ::tk_focusNext w {. set cur $w. while {1} {...# Descend to just before the first child of the current widget....set parent $cur..set children [winfo children $cur]..set i -1...# Look for the next sibling that isn't a top-level....while {1} {.. incr i..

C:\ProgramData\assignee\tk\fontchooser.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15611
Entropy (8bit):	4.711219778794195
Encrypted:	false
SSDEEP:	384:hQAVUJgrAP2Xg7V5M8Zyc8Ck/YN9G4EM8CPo:hQAVUJgrAP2Xg7V5MgycO/YpEX
MD5:	5126F7D9DFCA83B14D9BA17F571FE15B
SHA1:	8C6F56D67F1A0541557C63CF96143577EBD83F96
SHA-256:	3BF381F6E70593E8646F55D75AE42B0893A6ED076B92ED56205AC98093798A78
SHA-512:	9116E2D7EC465D649306215565EC7814E4D0D278BD46CE51A3083A9BCD22442778949A776C2D2248CEBDD4D3531EF5F6A585E00DE4856D06AA996E3E64C3A2D8
Malicious:	false
Preview:	# fontchooser.tcl -.#.#.A themeable Tk font selection dialog. See TIP #324..#.# Copyright (C) 2008 Keith Vetter.# Copyright (C) 2008 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::fontchooser {. variable S.. set S(W) .__tk__fontchooser. set S(fonts) [lsort -dictionary [font families]]. set S(styles) [list \. [::msgcat::mc "Regular"] \. [::msgcat::mc "Italic"] \. [::msgcat::mc "Bold"] \. [::msgcat::mc "Bold Italic"] \. ].. set S(sizes) {8 9 10 11 12 14 16 18 20 22 24 26 28 36 48 72}. set S(strike) 0. set S(under) 0. set S(first) 1. set S(sampletext) [::msgcat::mc "AaBbYyZz01"]. set S(-parent) .. set S(-title) [::msgcat::mc "Font"]. set S(-command) "". set S(-font) TkDefaultFont.. # Canoni

C:\ProgramData\assignee\tk\iconlist.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	15978
Entropy (8bit):	4.8947909611129905
Encrypted:	false
SSDEEP:	192:xj0OECzN+8JERNLKZhbgIDx3VM5BxBTSgvpn8WYYW5Xb50To3u8PYHPtJYa5PWDx:xrDJE36a7BegvV8hFI8gvXaSn9HqD/U0
MD5:	105529990CEE968AA5EE3BC827A81A0F
SHA1:	559BD1AABD1D4719EDB60448CF111F78365A57A9
SHA-256:	DE0195CCFB6482CCA390C94E91B7877F47742E7A9468CAF362B39AA36305D33C
SHA-512:	03CB42DFF7AC4F801AA7FFE8A4F07555CCE6874AA1B7F568ACF0299E4DD7F440179838485777F15183EE7C057CCB35868672B1783FBFE67B51D97DBBDAC85281
Malicious:	false
Preview:	# iconlist.tcl.#.#.Implements the icon-list megawidget used in the "Tk" standard file.#.selection dialog boxes..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..# Copyright (c) 2009 Donal K. Fellows.#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# API Summary:.#.tk::IconList <path> ?<option> <value>? ....#.<path> add <imageName> <itemList>.#.<path> cget <option>.#.<path> configure ?<option>? ?<value>? ....#.<path> deleteall.#.<path> destroy.#.<path> get <itemIndex>.#.<path> index <index>.#.<path> invoke.#.<path> see <index>.#.<path> selection anchor ?<int>?.#.<path> selection clear <first> ?<last>?.#.<path> selection get.#.<path> selection includes <item>.#.<path> selection set <first> ?<last>?...package require Tk 8.6..::tk::Megawidget create ::tk::IconList ::tk::FocusableWidget {. variable w canvas sbar accel accelCB fill font index \..itemList itemsPerColumn list maxIH maxIW maxTH maxTW noSc

C:\ProgramData\assignee\tk\icons.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	6.026473720997027
Encrypted:	false
SSDEEP:	192:TJjPyYK20kt4zHIXM2MxGwwOw0ac5lCssUOixDgzAjTXBHVXPZmEhr:pO2gz6MioacR2iBgzsFHX5r
MD5:	2652AAD862E8FE06A4EEDFB521E42B75
SHA1:	ED22459AD3D192AB05A01A25AF07247B89DC6440
SHA-256:	A78388D68600331D06BB14A4289BC1A46295F48CEC31CEFF5AE783846EA4D161
SHA-512:	6ECFBB8D136444A5C0DBBCE2D8A4206F1558BDD95F111D3587B095904769AC10782A9EA125D85033AD6532EDF3190E86E255AC0C0C81DC314E02D95CCA86B596
Malicious:	false
Preview:	# icons.tcl --.#.#.A set of stock icons for use in Tk dialogs. The icons used here.#.were provided by the Tango Desktop project which provides a.#.unified set of high quality icons licensed under the.#.Creative Commons Attribution Share-Alike license.#.(http://creativecommons.org/licenses/by-sa/3.0/).#.#.See http://tango.freedesktop.org/Tango_Desktop_Project.#.# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>..namespace eval ::tk::icons {}..image create photo ::tk::icons::warning -data {. iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAABSZJREFU. WIXll1toVEcYgL+Zc87u2Yu7MYmrWRuTJuvdiMuqiJd4yYKXgMQKVkSjFR80kFIVJfWCWlvpg4h9. 8sXGWGof8iKNICYSo6JgkCBEJRG8ImYThNrNxmaTeM7pQ5IlJkabi0/9YZhhZv7///4z/8zPgf+7. KCNRLgdlJijXwRyuDTlcxV9hbzv8nQmxMjg+XDtiOEplkG9PSfkztGmTgmFQd+FCVzwa3fYN/PHZ. AcpBaReicW5xcbb64IEQqko8Lc26d/58cxS+/BY6hmJvyEfQBoUpwWCmW1FErKaGWHU13uRk4QkE. UtxQNFR7QwIoB4eiKD9PWbVKbb10CZmaCqmpxCormRYO26QQx85B0mcD+AeK0xYvHqu1tNDx+DH6. g

C:\ProgramData\assignee\tk\images\README

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.341180398587801
Encrypted:	false
SSDEEP:	6:nVhmHdeA1xNZgkrIf3Ju4dFi6VbGWrWhr3W7FxmVFraGVAJFKyVQR7icrtpwB:nPqf1fZgZA4FJbB6dm7FUjAJVVMM
MD5:	FC8A86E10C264D42D28E23D9C75E7EE5
SHA1:	F1BA322448D206623F8FE734192F383D8F7FA198
SHA-256:	2695ADFF8E900C31B4D86414D22B8A49D6DD865CA3DD99678FA355CDC46093A8
SHA-512:	29C2DF0D516B5FC8E52CB61CFCD07AF9C90B40436DFE64CEFDB2813C0827CE65BA50E0828141256E2876D4DC251E934A6854A8E0B02CDAF466D0389BD778AEF0
Malicious:	false
Preview:	README - images directory..This directory includes images for the Tcl Logo and the Tcl Powered.Logo. Please feel free to use the Tcl Powered Logo on any of your.products that employ the use of Tcl or Tk. The Tcl logo may also be.used to promote Tcl in your product documentation, web site or other.places you so desire..

C:\ProgramData\assignee\tk\images\lamp.png

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8203
Entropy (8bit):	7.924091621678232
Encrypted:	false
SSDEEP:	192:hS2UlKfNqlk8dl7sUssP3N623q1CGNYp/X5Cigi:hS1tk8DsU33EnCeW/r
MD5:	26E2AAE12560628EEB4AD3C5D16A501F
SHA1:	52505F4ADFAEFCADB4EA2B58BE998EF6C89AB729
SHA-256:	88AD1D8E2F5FAABA91D354B3871D0BF4FB87E7216651BF2F31F16E67E05CA80B
SHA-512:	DB9B54BDCD13F9A6E2BD5D8319C4CB81D7FFF41F64A401DFF92FE07E49D1BE1D7B5850F4987C1BCA0E6B12A2A13D51CA7FA0223EDEA54253394BEA0B60E33C92
Malicious:	false
Preview:	.PNG........IHDR..............>a.....sBIT....\|.d.....pHYs..........u85....tEXtSoftware.www.inkscape.org..<.....IDATx..y\.....}CB.$. .U...0..-..8.qh.77M..m..oon..Ms.M.....i.f.I.......8.c.16.1;..,b.$.. ..?d.1....#}?.}$4.h.....<..i.A...6 .%(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(..'(...u..XhH......5Yy!V;W(..r.q..25.....RC0.d.4..4..=^.o...x)...1..0..T3.V.}2....E\o.0]##.....:i.....qs..8x....Qq[.9.tz...7.<..#..].....ei.y25m.S6..".b.~..7\|..D.=(.t..0f..v;.6;.v.X,&$.>.T@z..1..q.....!..dj.0......K..:....o..X....eK.o!...w..../.U.....OctT7e.......?._X...R..v..m....T...y..jM.C....K...F..vx<....x<$.$I...~.}m.O../...?..0..8...oo}....N....EZ..{..,+y....v...........G.5. .F.t:....f.M..r.r...f..e25=.Q.M.."..U..3.y]}"...C...@..o.X,d.3.\|Y...U}xE.......(=...w>.}..........i...9r.-.....Z....k.. 5....$"<..........\.E..II....I.\>=....X.nuT..H...7s_.+u'd....}..9...z...Y.....x.P.....

C:\ProgramData\assignee\tk\images\lamp.svg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	20354
Entropy (8bit):	4.464203241736894
Encrypted:	false
SSDEEP:	384:8t/wodr/bvPUOt30rXzWHeye5MXsktHu27yNp6shDhv1:8t51/bPXt32aHePkskt97+p6ID11
MD5:	4960CEB7F6D18016D9876A61CE016DB6
SHA1:	B2A203459DAA9C49BEE4BC1DF19CAC548BA461CE
SHA-256:	E222BBCCC879345C0F63E5311DCD7973DAB6BBCFC4FBDFC3E9107FFE184B2B97
SHA-512:	F2F5E8869741E23C1F1F830A161AA200A45DB9671D91BFBF3191DEBD1729C959359B224E38F1BFC0163CF4DEC1719ED4D064EE80CEA386B5EBD2D919AB37CCDE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="256". height="256". id="svg2". sodipodi:version="0.32". inkscape:version="0.46". version="1.0". sodipodi:docname="lamp.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape". inkscape:export-filename="C:\Users\pat\Documents\SVG\wish\lamp.png". inkscape:export-xdpi="45". inkscape:export-ydpi="45">. <defs. id="defs4">. <inkscape:perspective. sodipodi:type="inkscape:persp3d". inkscape:vp_x="0 : 526.18109 : 1". inkscape:vp_y="0 : 1000 : 0". i

C:\ProgramData\assignee\tk\images\logo.eps

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PostScript document text conforming DSC level 3.0, type EPS
Category:	dropped
Size (bytes):	32900
Entropy (8bit):	5.235207715374815
Encrypted:	false
SSDEEP:	768:gGTVOEcRWsdEmhp6k/GLrPMlK3pJr/IbYDGDMtBF2Fz6fsFA/fSvqHWukLI2d0Nr:gGTVOEcRWsdEvLrPJ5Jr/IbYDGDMtBFh
MD5:	45175418859AF67FE417BD0A053DB6E5
SHA1:	2B499B7C4EBC8554ECC07B8408632CAF407FB6D5
SHA-256:	F3E77FD94198EC4783109355536638E9162F9C579475383074D024037D1797D3
SHA-512:	114A59FD6B99FFD628BA56B8E14FB3B59A0AB6E752E18DEA038F85DBC072BF98492CE9369D180C169EDE9ED2BD521D8C0D607C5E4988F2C83302FC413C6D6A4C
Malicious:	false
Preview:	%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL/TK LOGO.ILLUS).%%CreationDate: (8/1/96) (4:58 PM).%%BoundingBox: 251 331 371 512.%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%DocumentCustomColors: (TCL RED).%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Level 2 Emul

C:\ProgramData\assignee\tk\images\logo100.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 68 x 100
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	6.9734417899888665
Encrypted:	false
SSDEEP:	48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
MD5:	FF04B357B7AB0A8B573C10C6DA945D6A
SHA1:	BCB73D8AF2628463A1B955581999C77F09F805B8
SHA-256:	72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
SHA-512:	10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
Malicious:	false
Preview:	GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

C:\ProgramData\assignee\tk\images\logo64.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 43 x 64
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	6.326462043862671
Encrypted:	false
SSDEEP:	48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
MD5:	B226CC3DA70AAB2EBB8DFFD0C953933D
SHA1:	EA52219A37A140FD98AEA66EA54685DD8158D9B1
SHA-256:	138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
SHA-512:	3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
Malicious:	false
Preview:	GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

C:\ProgramData\assignee\tk\images\logoLarge.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 354 x 520
Category:	dropped
Size (bytes):	11000
Entropy (8bit):	7.88559092427108
Encrypted:	false
SSDEEP:	192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
MD5:	45D9B00C4CF82CC53723B00D876B5E7E
SHA1:	DDD10E798AF209EFCE022E97448E5EE11CEB5621
SHA-256:	0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
SHA-512:	6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
Malicious:	false
Preview:	GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.^.x.....J.L.!.'........=+eZ..i..ynF.8...].y\|..m.

C:\ProgramData\assignee\tk\images\logoMed.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 87a, 120 x 181
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	7.425138719078912
Encrypted:	false
SSDEEP:	48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
MD5:	BD12B645A9B0036A9C24298CD7A81E5A
SHA1:	13488E4F28676F1E0CE383F80D13510F07198B99
SHA-256:	4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
SHA-512:	F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
Malicious:	false
Preview:	GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

C:\ProgramData\assignee\tk\images\pwrdLogo.eps

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PostScript document text conforming DSC level 3.0, type EPS
Category:	dropped
Size (bytes):	27809
Entropy (8bit):	5.331778921404698
Encrypted:	false
SSDEEP:	768:geQTVOEcRWsdEmhp6k/GLrPMlK3pJrNIbYDGDMtBgu2Fz6lR5G/r+FWaGK:gnTVOEcRWsdEvLrPJ5JrNIbYDGDMtB9L
MD5:	BA1051DBED2B8676CAA24593B88C91B2
SHA1:	8A58FC19B20BFDC8913515D9B32CCBF8ACF92344
SHA-256:	2944EBC4AF1894951BF9F1250F4E6EDF811C2183745950EA9A8A926715882CF7
SHA-512:	4260CEBA7DA9463F32B0C76A2AC19D2B20C8FE48CFBA3DC7AF748AAE15FA25DCBDA085072DF7EFC8F4B4F304C7ED166FE9F93DC903E32FA1874E82D59E544DEF
Malicious:	false
Preview:	%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL PWRD LOGO.ILLUS).%%CreationDate: (8/1/96) (4:59 PM).%%BoundingBox: 242 302 377 513.%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Le

C:\ProgramData\assignee\tk\images\pwrdLogo100.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 64 x 100
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	7.461273815456419
Encrypted:	false
SSDEEP:	48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
MD5:	DBFAE61191B9FADD4041F4637963D84F
SHA1:	BD971E71AE805C2C2E51DD544D006E92363B6C0C
SHA-256:	BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
SHA-512:	ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
Malicious:	false
Preview:	GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v\|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......\|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8OZ.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.\|..pf!..&.......8.#.8.......J>. .t..h6(........#..0.A...!..)...x..u.Z....%..H............`......\|.....1.......&.....T...f.l...

C:\ProgramData\assignee\tk\images\pwrdLogo150.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 97 x 150
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	7.708754027741608
Encrypted:	false
SSDEEP:	48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
MD5:	711F4E22670FC5798E4F84250C0D0EAA
SHA1:	1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
SHA-256:	5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
SHA-512:	220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
Malicious:	false
Preview:	GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>\|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

C:\ProgramData\assignee\tk\images\pwrdLogo175.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 113 x 175
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	7.758793907956808
Encrypted:	false
SSDEEP:	48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
MD5:	DA5FB10F4215E9A1F4B162257972F9F3
SHA1:	8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
SHA-256:	62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
SHA-512:	990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
Malicious:	false
Preview:	GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....0p}..KP?c.\@KW.S(..M..B.....-q...S2....,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.4..(..........F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

C:\ProgramData\assignee\tk\images\pwrdLogo200.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 130 x 200
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	7.790611381196208
Encrypted:	false
SSDEEP:	96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
MD5:	A5E4284D75C457F7A33587E7CE0D1D99
SHA1:	FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
SHA-256:	BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
SHA-512:	4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
Malicious:	false
Preview:	GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R......J.p.A.t...$A...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y135.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. .....Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'\|..M9..."...,.......

C:\ProgramData\assignee\tk\images\pwrdLogo75.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 48 x 75
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.289201491091023
Encrypted:	false
SSDEEP:	24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
MD5:	7013CFC23ED23BFF3BDA4952266FA7F4
SHA1:	E5B1DED49095332236439538ECD9DD0B1FD4934B
SHA-256:	462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
SHA-512:	A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
Malicious:	false
Preview:	GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .\|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N\|...f..J.x... P&.\|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..\|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

C:\ProgramData\assignee\tk\images\tai-ku.gif

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	dropped
Size (bytes):	5473
Entropy (8bit):	7.754239979431754
Encrypted:	false
SSDEEP:	96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
MD5:	048AFE69735F6974D2CA7384B879820C
SHA1:	267A9520C4390221DCE50177E789A4EBD590F484
SHA-256:	E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
SHA-512:	201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
Malicious:	false
Preview:	GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa.....p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..\|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......EfY3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

C:\ProgramData\assignee\tk\license.terms

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	5.097909341674822
Encrypted:	false
SSDEEP:	48:JlZuZcRTvy3DauG4+bHnr32s3eGw8YKxPiOXR3ojdS+mFf:JScFaz+bL3e8n3XR3ojdtOf
MD5:	C88F99DECEC11AFA967AD33D314F87FE
SHA1:	58769F631EB2C8DED0C274AB1D399085CC7AA845
SHA-256:	2CDE822B93CA16AE535C954B7DFE658B4AD10DF2A193628D1B358F1765E8B198
SHA-512:	4CD59971A2614891B2F0E24FD8A42A706AE10A2E54402D774E5DAA5F6A37DE186F1A45B1722A7C0174F9F80625B13D7C9F48FDB03A7DDBC6E6881F56537B5478
Malicious:	false
Preview:	This software is copyrighted by the Regents of the University of.California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState.Corporation, Apple Inc. and other parties. The following terms apply to.all files associated with the software unless explicitly disclaimed in.individual files...The authors hereby grant permission to use, copy, modify, distribute,.and license this software and its documentation for any purpose, provided.that existing copyright notices are retained in all copies and that this.notice is included verbatim in any distributions. No written agreement,.license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors.and need not follow the licensing terms described here, provided that.the new terms are clearly indicated on the first page of each file where.they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY.FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQ

C:\ProgramData\assignee\tk\listbox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14377
Entropy (8bit):	4.889831362048007
Encrypted:	false
SSDEEP:	384:ZUjtAcsYusFvyg26UzcDkHjNw8iSdy+1a22YDKD:ZhgdUjjW8TQcK
MD5:	80E807DC61F9CA29D96DB7F5E9F0C153
SHA1:	1CE8BC890A8695108D1DCD926BDBF6B7BE24D908
SHA-256:	6510A18F07DAA43C3D2739114D19F159B4BE07DD953207149E115B9AA795DC7B
SHA-512:	1C694FF97F6E9D44AAF9156B970AA315D5583DB0E55093ECC93DF3612FB3098614626DB0652431EA74AA2F332B95335B3D6A4B0B7340C2808394B2E5EE583CCE
Malicious:	false
Preview:	# listbox.tcl --.#.# This file defines the default bindings for Tk listbox widgets.# and provides procedures that help in implementing those bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#--------------------------------------------------------------------------.# tk::Priv elements used in this file:.#.# afterId -..Token returned by "after" for autoscanning..# listboxPrev -..The last element to be selected or deselected.#...during a selection operation..# listboxSelection -.All of the items that were selected before the.#...current selection operation (such as a mouse.#...drag) started; used to cancel an operation..#--------------------------------------------------------------------------..#------------------------------------

C:\ProgramData\assignee\tk\megawidget.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	3499
Entropy (8bit):	4.9207747067421765
Encrypted:	false
SSDEEP:	96:vGoVmqMwOIhNNiadrcOoePy46kLdeOhL+DqBQdU0Q:cpQqqcOjyLk4Ol+mBQUH
MD5:	E387929961A8A535E573E25D2907769C
SHA1:	9C7A1CBDB143D4B4F4528956CFCCC727EE2E258C
SHA-256:	EC12BB3728714E5ADF23BB9CD27D7CEC0CB3C14E9BDB352D7631F25341B885FF
SHA-512:	84B80E12F137FCEF33804CD553F03E114FA32AE1FBA6247632425F45F83587A87644817876F82D5DDC2ACBA8E98B6332E2F8AE04529D74E12B8DF4D6C1A179F6
Malicious:	false
Preview:	# megawidget.tcl.#.#.Basic megawidget support classes. Experimental for any use other than.#.the ::tk::IconList megawdget, which is itself only designed for use in.#.the Unix file dialogs..#.# Copyright (c) 2009-2010 Donal K. Fellows.#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#..package require Tk 8.6...::oo::class create ::tk::Megawidget {. superclass ::oo::class. method unknown {w args} {..if {[string match .* $w]} {.. [self] create $w {}$args.. return $w..}..next $w {}$args. }. unexport new unknown. self method create {name superclasses body} {..next $name [list \...superclass ::tk::MegawidgetClass {*}$superclasses]\;$body. }.}..::oo::class create ::tk::MegawidgetClass {. variable w hull OptionSpecification options IdleCallbacks. constructor args {..# Extract the "widget name" from the object name..set w [namespace tail [self]]...# Configure things..set OptionSpe

C:\ProgramData\assignee\tk\menu.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	37893
Entropy (8bit):	4.877192521810372
Encrypted:	false
SSDEEP:	768:0K5IICrnC0aJtVbQDFTo06WpSCeihpzuxdNQYEuH9DAWJ:0K51ICTs69WuxdCYxHSo
MD5:	9FDB3D03C7AA00CE5E0292E44ED4BF8B
SHA1:	3660D532A1B1B5C6E08BDBB55BF3CFFD3C14465F
SHA-256:	20C7CBE9CA72BE4B3572B3A51E50BADCBFFC3735C14E50E82AD2C8034F1BC43B
SHA-512:	4E7E8C46F4D3FC386402B5F243DDAE4C254830CC0B83A38B769B9C0F87D426273529364D547B7BFCEC785B0EF134367A061135EB9E52B0C55FAF1D94D00E368D
Malicious:	false
Preview:	# menu.tcl --.#.# This file defines the default bindings for Tk menus and menubuttons..# It also implements keyboard traversal of menus and implements a few.# other utility procedures related to menus..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998-1999 by Scriptics Corporation..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# cursor -..Saves the -cursor option for the posted menubutton..# focus -..Saves the focus during a menu selection operation..#...Focus gets restored here when the menu is unposted..# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if.#...tk::Priv(oldGrab) is non-empty, then tk::Pr

C:\ProgramData\assignee\tk\mkpsenc.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29355
Entropy (8bit):	5.110363453013207
Encrypted:	false
SSDEEP:	768:hmie+xwcBO/SHAqFySrhkvQueYpx8DPF52UdREXXZ2/OODi:I+xwcBO/SHAqFySrhAQueYD8D95vOL
MD5:	DEEA68551082F30EC84E7C5C742DD137
SHA1:	58F73D2F42B3929460CCFE8EE3CE2481F5DF3060
SHA-256:	C9AC618A69AD5A08D56A4289C64BC7E60F64AB7B7CA433366A29AC9E3F530A0C
SHA-512:	BC6B5985C840C645A5BBEB5F3A6322C594E75285A466377163DF4E39EED71A15223FEB2FF5C1641EC67DA7A8C3A922CE118D30259CCBB8C7BC9F89C249D1253A
Malicious:	false
Preview:	# mkpsenc.tcl --.#.# This file generates the postscript prolog used by Tk...namespace eval ::tk {. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically. # handle any 8-bit encoding, but Tk never generates characters outside. # ASCII).. #. proc CreatePostscriptEncoding {} {..variable psglyphs..# Now check for known. Even if it is known, it can be other than we..# need. GhostScript seems to be happy with such approach..set result "\[\n"..for {set i 0} {$i<256} {incr i 8} {.. for {set j 0} {$j<8} {incr j} {...set enc [encoding convertfrom "iso8859-1" \....[format %c [expr {$i+$j}]]]...catch {... set hexcode {}... set hexcode [format %04X [scan $enc %c]]...}...if {[info exists psglyphs($hexcode)]} {... append result "/$psglyphs($hexcode)"...} else {... append result "/space"...}.. }.. append result "\n"..}..append result "\]"..return $result. }.. # List of adobe glyph names. Converted from glyphlist.txt, downloaded from. # Ad

C:\ProgramData\assignee\tk\msgbox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	xbm image (32x, ASCII text
Category:	dropped
Size (bytes):	16487
Entropy (8bit):	4.678830353521387
Encrypted:	false
SSDEEP:	384:aWsDPYblrrfcccfjAwnAVD7S3ifQjvwMXEcjY:aTccfjAwG7fQjvPXt0
MD5:	B28FF0AAC26644B63C850EEDE94ABD48
SHA1:	B126C4834BB6CE8350A98C3B84C01AFC14ADA7D3
SHA-256:	BAD6B0560BFF57A050181D8210A7ABBA682BC2327F9DB3D3FF2C703A37594E13
SHA-512:	6DA15E62732756C85B2DD39AE9C8F6BD3DEFD54424AF084C87444CE32E562ADC858B05D0DB58A154D9156D82BBB741358B13D81E968B12892534BA6D6155C594
Malicious:	false
Preview:	# msgbox.tcl --.#.#.Implements messageboxes for platforms that do not have native.#.messagebox support..#.# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# Ensure existence of ::tk::dialog namespace.#.namespace eval ::tk::dialog {}..image create bitmap ::tk::dialog::b1 -foreground black \.-data "#define b1_width 32\n#define b1_height 32.static unsigned char q1_bits[] = {. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x04, 0x00, 0x00, 0x20, 0x08, 0x00,

C:\ProgramData\assignee\tk\msgs\cs.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4158
Entropy (8bit):	4.744283779865612
Encrypted:	false
SSDEEP:	48:RC98Kz+4GgKafRXwSl51gmJnANlsgPVG5QOFWQfl5:RC98/4PGi51gmAsgPVjm5
MD5:	EBAFA3EE899EBB06D52C204493CEE27A
SHA1:	95E6C71E4525A8DD91E488B952665AE9C5FBDDED
SHA-256:	D1B0FED0BEA51B3FAF08D8634034C7388BE7148F9B807460B7D185706DB8416F
SHA-512:	ADDE3C85A7A4148BAFD6C8B8902FC8C229F1D1AAF118BE85F44E4667237E66938864E2B7B4486B7C68C89EB4559F1D8367F9F563B9C6C8BCAB66118B36E670B8
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it". ::msgcat::mcset cs "&About..." "&O programu...". ::msgcat::mcset cs "All Files" "V\u0161echny soubory". ::msgcat::mcset cs "Application Error" "Chyba programu". ::msgcat::mcset cs "Bold Italic". ::msgcat::mcset cs "&Blue" "&Modr\341". ::msgcat::mcset cs "Cancel" "Zru\u0161it". ::msgcat::mcset cs "&Cancel" "&Zru\u0161it". ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.". ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e". ::msgcat::mcset cs "Cl&ear" "Sma&zat". ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu". ::msgcat::mcset cs "Color" "Barva". ::msgcat::mcset cs "Console" "Konzole". ::msgcat::mcset cs "&Copy" "&Kop\355rovat". ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout". ::msgcat::mcset cs "&Delete" "&Smazat"

C:\ProgramData\assignee\tk\msgs\da.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3909
Entropy (8bit):	4.6030170761850915
Encrypted:	false
SSDEEP:	48:G8ONjSf5s80vWCUx5kTvgXTfODYE9lAUt:G8OmB0ZUx5kTv4sbt
MD5:	C414C6972F0AAD5DFA31297919D0587F
SHA1:	529AE0B0CB9D1DBC7F8844F346149E151DE0A36B
SHA-256:	85E6CEE6001927376725F91EAA55D17B3D9E38643E17755A42C05FE491C63BDE
SHA-512:	0F2A777B9C3D6C525097E19D1CC4525E9BAF78E0CABF54DD693C64BC1FD4EA75402D906A8302489997BA83ABA5AFD7CA1DE30FFE0888CD19950F56A9D38B018A
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset da "&Abort" "&Afbryd". ::msgcat::mcset da "&About..." "&Om...". ::msgcat::mcset da "All Files" "Alle filer". ::msgcat::mcset da "Application Error" "Programfejl". ::msgcat::mcset da "&Blue" "&Bl\u00E5". ::msgcat::mcset da "Cancel" "Annuller". ::msgcat::mcset da "&Cancel" "&Annuller". ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.". ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog". ::msgcat::mcset da "Cl&ear" "&Ryd". ::msgcat::mcset da "&Clear Console" "&Ryd konsolen". ::msgcat::mcset da "Color" "Farve". ::msgcat::mcset da "Console" "Konsol". ::msgcat::mcset da "&Copy" "&Kopier". ::msgcat::mcset da "Cu&t" "Kli&p". ::msgcat::mcset da "&Delete" "&Slet". ::msgcat::mcset da "Details >>" "Detailer". ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" findes ikke.". ::msg

C:\ProgramData\assignee\tk\msgs\de.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4823
Entropy (8bit):	4.5738552657551566
Encrypted:	false
SSDEEP:	96:13LquGgagtG6vz8MFi9dDvbwKAN92qqMXg07Qt:L1/w5jwKYH1Et
MD5:	07DF877A1166E81256273F1183B5BDC9
SHA1:	CB455F910208E2E55B27A96ABD845FEEDA88711A
SHA-256:	06DD7572626DF5CB0A8D3AFFBAC9BB74CB12469076836D66FD19AE5B5FAB42C7
SHA-512:	197B09F37647D1D5130A084EA1D99D0CC16C815EC0AC31EC07875BEB2DFAE2197E2AF3E323FE8CB35F90912D76D3EB88D1E56F6E026F87AEDFADB7534BA2675A
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset de "&Abort" "&Abbruch". ::msgcat::mcset de "&About..." "&\u00dcber...". ::msgcat::mcset de "All Files" "Alle Dateien". ::msgcat::mcset de "Application Error" "Applikationsfehler". ::msgcat::mcset de "&Apply" "&Anwenden". ::msgcat::mcset de "Bold" "Fett". ::msgcat::mcset de "Bold Italic" "Fett kursiv". ::msgcat::mcset de "&Blue" "&Blau". ::msgcat::mcset de "Cancel" "Abbruch". ::msgcat::mcset de "&Cancel" "&Abbruch". ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.". ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis". ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen". ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen". ::msgcat::mcset de "Color" "Farbe". ::msgcat::mcset de "Console" "Konsole". ::msgcat::mcset de "&Copy" "&Kopieren". ::msgcat::mcset de "Cu&t" "Aus&schneid

C:\ProgramData\assignee\tk\msgs\el.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text, with very long lines (355)
Category:	dropped
Size (bytes):	8698
Entropy (8bit):	4.296709418881547
Encrypted:	false
SSDEEP:	48:tCrF5o/cmSHbkI8+ETnFI3mC2hk9I+c6M30UPfMNDz91yBFkm5w+kGR8MOFiL0xu:wp5RmSHlsFerVIfM5Loam5VOMAkV
MD5:	C802EA5388476451CD76934417761AA6
SHA1:	25531DF6262E3B1170055735C5A874B9124FEA83
SHA-256:	1D56D0A7C07D34BB8165CBA47FA49351B8BC5A9DB244290B9601C5885D16155C
SHA-512:	251FABBE8B596C74BC1231823C60F5F99CF55A29212327723F5DBE604F678E8E464F2D604D1049754B7C02350712B83BCF4D9542D8167F3CAB9C9B7E5C88EC7D
Malicious:	false
Preview:	## Messages for the Greek (Hellenic - "el") language..## Please report any changes/suggestions to:.## petasis@iit.demokritos.gr..namespace eval ::tk {. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2". ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...". ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1". ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2". ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5". ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7". ::msgcat::mcset el \."Cannot change to the directory \"%1\$s\".\nPermission denied." \."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u03ae \u03ba\u

C:\ProgramData\assignee\tk\msgs\en.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3286
Entropy (8bit):	4.214322279125194
Encrypted:	false
SSDEEP:	24:sqHa4IUXCtvLPgyq1+1ylnJzqFtC2NAXSxFFRRTDubLorIlnB:d64I5tDPgDNnH2SXSZRRTDuPZlB
MD5:	64725ED622DBF1CB3F00479BA84157D7
SHA1:	575429AEABAF6640425AC1BC397B3382C1ED1122
SHA-256:	673C76A48ADA09A154CB038534BF90E3B9C0BA5FD6B1619DB33507DE65553362
SHA-512:	4EBDCAB20D095789BB8D94476CCFD29DEE8DFCF96F1C2030387F0521827A140E22BBB0DAD4B73EABE26D70E1642C9981BC5CBBF0045FEABB9EF98C7CDB67795E
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset en "&Abort". ::msgcat::mcset en "&About...". ::msgcat::mcset en "All Files". ::msgcat::mcset en "Application Error". ::msgcat::mcset en "&Apply". ::msgcat::mcset en "Bold". ::msgcat::mcset en "Bold Italic". ::msgcat::mcset en "&Blue". ::msgcat::mcset en "Cancel". ::msgcat::mcset en "&Cancel". ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.". ::msgcat::mcset en "Choose Directory". ::msgcat::mcset en "Cl&ear". ::msgcat::mcset en "&Clear Console". ::msgcat::mcset en "Color". ::msgcat::mcset en "Console". ::msgcat::mcset en "&Copy". ::msgcat::mcset en "Cu&t". ::msgcat::mcset en "&Delete". ::msgcat::mcset en "Details >>". ::msgcat::mcset en "Directory \"%1\$s\" does not exist.". ::msgcat::mcset en "&Directory:". ::msgcat::mcset en "&Edit". ::msgcat::mcset en "Effects". ::msgcat::mcset en "Error: %1\$s". ::msgcat::mcset en "E&xit". ::msgcat

C:\ProgramData\assignee\tk\msgs\en_gb.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.185724027617087
Encrypted:	false
SSDEEP:	3:fEGp6fR1FAGoW8vMKEQXK:sooLoQO6
MD5:	EC6A7E69AB0B8B767367DB54CC0499A8
SHA1:	6C2D6B622429AB8C17E07C2E0F546469823ABE57
SHA-256:	FB93D455A9D9CF3F822C968DFB273ED931E433F2494D71D6B5F8D83DDE7EACC2
SHA-512:	72077EAB988979EB2EE292ACDB72537172A5E96B4262CE7278B76F0FEBD7E850D18221DB551D1DE3C6EB520985B5E9642936BEEB66032F920593276784525702
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset en_gb Color Colour.}.

C:\ProgramData\assignee\tk\msgs\eo.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3916
Entropy (8bit):	4.556739397782912
Encrypted:	false
SSDEEP:	48:9714zhrzeU10xrFf+/eR0Mqp+cIFIXd/KcrtCcuUc6Sq4Pe:97145eFrF2GSMqgcIFIXdyAene
MD5:	09EF4B30B49A71FD4DEA931E334896E1
SHA1:	6C2366CE5961CFDA53259A43E087A813CEE41841
SHA-256:	5DE113DC4CE0DF0D8C54D4812C15EC31387127BF9AFEA028D20C6A5AA8E3AB85
SHA-512:	9DB3BB6B76B1299AE4612DF2A2872ECEE6642FC7DF971BE3A22437154AD25E81E1B1F3E1AA7A281CB3F48F8F8198A846BCB008CCFF91A9720440AFE5BAB7DE84
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset eo "&Abort" "&\u0108esigo". ::msgcat::mcset eo "&About..." "Pri...". ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj". ::msgcat::mcset eo "Application Error" "Aplikoerraro". ::msgcat::mcset eo "&Blue" "&Blua". ::msgcat::mcset eo "Cancel" "Rezignu". ::msgcat::mcset eo "&Cancel" "&Rezignu". ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.". ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo". ::msgcat::mcset eo "Cl&ear" "&Klaru". ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon". ::msgcat::mcset eo "Color" "Farbo". ::msgcat::mcset eo "Console" "Konzolo". ::msgcat::mcset eo "&Copy" "&Kopiu". ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu". ::msgcat::mcset eo "&Delete" "&Forprenu". ::msgcat::mcset eo "Details >>" "Detaloj >>". ::msgcat::mcset eo "Directory \"%1\$s\" does not exist." "La dosieruj

C:\ProgramData\assignee\tk\msgs\es.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3950
Entropy (8bit):	4.4851488130447414
Encrypted:	false
SSDEEP:	48:vTEZD2XRgGiWXirZe0uoH02QyTaBi2DcDmQ/jY33lEzTCyFv:voZaXhFbyGB3ELxDV
MD5:	2DFA9FB54426C2A86370197C795F01B2
SHA1:	0E3918565DFED950A54E99633475B98D1E1596A7
SHA-256:	5B30F40CDCBC5FABC10A1D7650668509F88D73D1A35F9A8A1D9E72E3D7E85986
SHA-512:	48515A4878F5F4CB6B5FA564E5956FF7AD91527B82435E0F27210D565C7B506AACE7DC5F1432D38C5E9F50ED42B7B2ED1A2214570CB6454C9668C53245EBD5D2
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset es "&Abort" "&Abortar". ::msgcat::mcset es "&About..." "&Acerca de ...". ::msgcat::mcset es "All Files" "Todos los archivos" . ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n". ::msgcat::mcset es "&Blue" "&Azul". ::msgcat::mcset es "Cancel" "Cancelar". ::msgcat::mcset es "&Cancel" "&Cancelar". ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.". ::msgcat::mcset es "Choose Directory" "Elegir directorio". ::msgcat::mcset es "Cl&ear" "&Borrar". ::msgcat::mcset es "&Clear Console" "&Borrar consola". ::msgcat::mcset es "Color". ::msgcat::mcset es "Console" "Consola". ::msgcat::mcset es "&Copy" "&Copiar". ::msgcat::mcset es "Cu&t" "Cor&tar". ::msgcat::mcset es "&Delete" "&Borrar". ::msgcat::mcset es "Details >>" "Detalles >>". ::msgcat::mcset es "Directory \"%1\$s\" does not exist."

C:\ProgramData\assignee\tk\msgs\fr.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	4.582498923493114
Encrypted:	false
SSDEEP:	48:fiESNtfQIFBqFHjUp4KiOzbgRuhzSAEFlBGr3jd:fiESP1aVdKiHRXcN
MD5:	9FC55235C334F6F6026D5B38AFFB9E10
SHA1:	CAD3805900E860B9491E3EE5C2C0F52ADCA67065
SHA-256:	0A8BBB4D1FD87BF7A90DDFA50F4724994C9CE78D1F3E91CF40C1177DB7941DC5
SHA-512:	FBB5E72BC376DDB9F43B8C79398CA287AFAAAF8292A8CB3AF63241973B1748FD578D49075A1287DA054BA81D3ED61A723F3DE9E10855D5E85620B371D70D9BBD
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset fr "&Abort" "&Annuler". ::msgcat::mcset fr "About..." "\u00c0 propos...". ::msgcat::mcset fr "All Files" "Tous les fichiers". ::msgcat::mcset fr "Application Error" "Erreur d'application". ::msgcat::mcset fr "&Blue" "&Bleu". ::msgcat::mcset fr "Cancel" "Annuler". ::msgcat::mcset fr "&Cancel" "&Annuler". ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.". ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire". ::msgcat::mcset fr "Cl&ear" "Effacer". ::msgcat::mcset fr "Color" "Couleur". ::msgcat::mcset fr "Console". ::msgcat::mcset fr "Copy" "Copier". ::msgcat::mcset fr "Cu&t" "Couper". ::msgcat::mcset fr "Delete" "Effacer". ::msgcat::mcset fr "Details >>" "D\u00e9tails >>". ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\" n'existe pas.".

C:\ProgramData\assignee\tk\msgs\hu.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.752507976327236
Encrypted:	false
SSDEEP:	96:IYIzxGy0Kt9C81y/HSzVqUaJf9q/x5a/mETsN:IB1FCt/4vZM+EA
MD5:	E1BA9C40A350BAD78611839A59065BF0
SHA1:	1A148D230C9F8D748D96A79CD4E261AF264D6524
SHA-256:	C8134EAD129E44E9C5043E1DAD81A6A900F0DE71DB3468E2603840038687F1D8
SHA-512:	17EC7F14C708C4D8C77731C26D0CE8AF6EBAB3D1CA878FB9682F15F0546031E39EF601683832631CA329549A630F2C9A3A69B1CC6E3CC927353605834FC62CAE
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s". ::msgcat::mcset hu "&About..." "N\u00e9vjegy...". ::msgcat::mcset hu "All Files" "Minden f\u00e1jl". ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba". ::msgcat::mcset hu "&Blue" "&K\u00e9k". ::msgcat::mcset hu "Cancel" "M\u00e9gsem". ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem". ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.". ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa". ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s". ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol". ::msgcat::mcset hu "Color" "Sz\u00edn". ::msgcat::mcset hu "Console" "Konzol". ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s". ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s". ::msgcat::mcset hu "

C:\ProgramData\assignee\tk\msgs\it.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3692
Entropy (8bit):	4.444986253861924
Encrypted:	false
SSDEEP:	48:rtcxronR9zvjZ3hWsH9TYT/dllvOr80nC2dnGHc839kUqg:xcxoXBhlHiT/dlcY0HpVg
MD5:	ADB80EC5B23FC906A1A3313A30D789E6
SHA1:	5FB163BC1086D3366228204078F219FE4BB67CB3
SHA-256:	9F83DD0309ED621100F3187FFCDAE50B75F5973BBE74AF550A78EF0010495DED
SHA-512:	BA6E0C165561CDAEAB565EF1FED4087AB3B41EC3C18432C1BDA9B011E5C7C2E12F6B2CFC9F5C0CFAC1134AE53D80459D8E5B638739C61A851232047DEA7F3BA2
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset it "&Abort" "&Interrompi". ::msgcat::mcset it "&About..." "Informazioni...". ::msgcat::mcset it "All Files" "Tutti i file". ::msgcat::mcset it "Application Error" "Errore dell' applicazione". ::msgcat::mcset it "&Blue" "&Blu". ::msgcat::mcset it "Cancel" "Annulla". ::msgcat::mcset it "&Cancel" "&Annulla". ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.". ::msgcat::mcset it "Choose Directory" "Scegli una directory". ::msgcat::mcset it "Cl&ear" "Azzera". ::msgcat::mcset it "&Clear Console" "Azzera Console". ::msgcat::mcset it "Color" "Colore". ::msgcat::mcset it "Console". ::msgcat::mcset it "&Copy" "Copia". ::msgcat::mcset it "Cu&t" "Taglia". ::msgcat::mcset it "Delete" "Cancella". ::msgcat::mcset it "Details >>" "Dettagli >>". ::msgcat::mcset it "Directory \"%1\$s\" does not exist." "La director

C:\ProgramData\assignee\tk\msgs\nl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4466
Entropy (8bit):	4.472386382725933
Encrypted:	false
SSDEEP:	48:791wMjS3Md15YNISfTMEu5KIXTLLBIafWUuvfbLnZj4gT7VT4k7BLyslwI6Blb4t:DVe3MX8ISUKYuXbLnZj4MRJhjSIO4t
MD5:	B628EAFD489335ED620014B56821B792
SHA1:	8F6AFF68B42B747D30870D6DA7E058294921406A
SHA-256:	D3D07AAD792C0E83F4704B304931EA549D12CBB3D99A573D9815E954A5710707
SHA-512:	C33D097D2897D20F75A197E30B859DC83C8B4E42F260150BC7205918779D77A8C2390BE65376622F6705C38ECDF6F14B6ABAD29EDE3DE79603025BBBC39BEBC7
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset nl "&Abort" "&Afbreken". ::msgcat::mcset nl "&About..." "Over...". ::msgcat::mcset nl "All Files" "Alle Bestanden". ::msgcat::mcset nl "Application Error" "Toepassingsfout". ::msgcat::mcset nl "&Apply" "Toepassen". ::msgcat::mcset nl "Bold" "Vet". ::msgcat::mcset nl "Bold Italic" "Vet Cursief". ::msgcat::mcset nl "&Blue" "&Blauw". ::msgcat::mcset nl "Cancel" "Annuleren". ::msgcat::mcset nl "&Cancel" "&Annuleren". ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.". ::msgcat::mcset nl "Choose Directory" "Kies map". ::msgcat::mcset nl "Cl&ear" "Wissen". ::msgcat::mcset nl "&Clear Console" "&Wis Console". ::msgcat::mcset nl "Color" "Kleur". ::msgcat::mcset nl "Console". ::msgcat::mcset nl "&Copy" "Kopi\u00ebren". ::msgcat::mcset nl "Cu&t" "Knippen". ::msgcat::mcset nl "&Delete" "Wissen". ::

C:\ProgramData\assignee\tk\msgs\pl.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.754441208797498
Encrypted:	false
SSDEEP:	48:mYpnddv1H+BBv5vVXKjB+y7ldBU63XQ3DGHolytTzEQdWaz0ybBaKG:zpdzH+3vLKnG63XdHoMpYYaL
MD5:	17B63EFE0A99F44D27DD41C4CC0A8A7B
SHA1:	3E45C0102B287908D770A31D1906678E785088C2
SHA-256:	1993B4EC2DC009D2E6CA185D0BD565D3F33A4EFA79BACA39E4F97F574D63F305
SHA-512:	F8B9E7BC76A4ED5F948A9E505F3B1A321E322DD57CF88BEF36B6A9AF793462E45432709402151B4BB520B12B089A043CA23FF86106ED7B5C73DFBB6E233907F4
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset pl "&Abort" "&Przerwij". ::msgcat::mcset pl "&About..." "O programie...". ::msgcat::mcset pl "All Files" "Wszystkie pliki". ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie". ::msgcat::mcset pl "&Apply" "Zastosuj". ::msgcat::mcset pl "Bold" "Pogrubienie". ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa". ::msgcat::mcset pl "&Blue" "&Niebieski". ::msgcat::mcset pl "Cancel" "Anuluj". ::msgcat::mcset pl "&Cancel" "&Anuluj". ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.". ::msgcat::mcset pl "Choose Directory" "Wybierz katalog". ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107". ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119". ::msgcat::mcset pl "Color" "Kolor". ::msgcat::mcset pl "Console" "Konsola". ::msgcat::mcset pl "&Copy" "&Kopiuj". ::msgcat::

C:\ProgramData\assignee\tk\msgs\pt.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3913
Entropy (8bit):	4.5841256573492135
Encrypted:	false
SSDEEP:	48:k82mOQNHHouc2Ib2dxwj0Hpn4KeJ4iFHh29wDPK8+i92M5L:k82mOenox2x5Hp47mi3ZUMB
MD5:	236356817E391D8871EA59667F47DA0C
SHA1:	948EE95F4549DA8C7D412911D17B4B62CBA22ADD
SHA-256:	AD0E466131D3789DE321D9D0588E19E4647BA82EDE41EEE6EBEF464786F8BDBE
SHA-512:	3AB10D1980D4C1367EA0BB54E50709DF32A870E851EDE80F30F66DA4B09C1ACFFF4E77C462BD815DD67F485DDFF77FEBD09CA29D77EEE55FE8A00D115D600C32
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset pt "&Abort" "&Abortar". ::msgcat::mcset pt "About..." "Sobre ...". ::msgcat::mcset pt "All Files" "Todos os arquivos". ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o". ::msgcat::mcset pt "&Blue" "&Azul". ::msgcat::mcset pt "Cancel" "Cancelar". ::msgcat::mcset pt "&Cancel" "&Cancelar". ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.". ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio". ::msgcat::mcset pt "Cl&ear" "Apagar". ::msgcat::mcset pt "&Clear Console" "Apagar Console". ::msgcat::mcset pt "Color" "Cor". ::msgcat::mcset pt "Console". ::msgcat::mcset pt "&Copy" "Copiar". ::msgcat::mcset pt "Cu&t" "Recortar". ::msgcat::mcset pt "&Delete" "Excluir". ::msgcat::mcset pt "Details >>" "Detalhes >>". ::msgcat::mcset pt "Directory \"%1\$s\"

C:\ProgramData\assignee\tk\msgs\ru.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7216
Entropy (8bit):	4.358336994200717
Encrypted:	false
SSDEEP:	96:ZUEBGTT4Ys7LT3xXkhX2xSrwFlOzFAnxE/j49cDRqRjGSQvN8Nfo5hgV9aWTRtaa:SraFGIm6+4RKOGqRyRu
MD5:	B55BB53FB415EAC56C87E270A9A9C4A9
SHA1:	E3C35497437C8B1BC1DE812964EDFFF8C318BAC8
SHA-256:	32D7A993ED7EEDEEB61A835AFAC2F9EC703EA148767C18A34E236AA233455028
SHA-512:	2591FA8655A91EAF9D7983046F0A9F2B733ADAC564D21AD57D14BAC93C19E5AEF388EF05EB95C52528756181C133C1CCF44DF98F9D287CB07324F425125B5E7A
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c". ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...". ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b". ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435". ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439". ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \...."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430".

C:\ProgramData\assignee\tk\msgs\sv.msg

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3832
Entropy (8bit):	4.609382297476727
Encrypted:	false
SSDEEP:	48:g4HXcfWBJdE10M4/00li6z8XIxTB2iDxypdmmZbWxOt:FXcf6H00li9IxTEbQsb7t
MD5:	DB1712B1C1FF0E3A46F8E86FBB78AA4D
SHA1:	28D9DB9CBEE791C09BD272D9C2A6C3DA80EB89EA
SHA-256:	B76EBFA21BC1E937A04A04E5122BE64B5CDEE1F47C7058B71D8B923D70C3B17B
SHA-512:	F79CD72DCD6D1B4212A5058DA5A020E8A157E72E6D84CAFB96463E76C1CED5AC367A2295EF743FDE70C9AB1CF2F4D88A4A73300DFD4F799AA3ECDA6FBF04E588
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset sv "&Abort" "&Avsluta". ::msgcat::mcset sv "&About..." "&Om...". ::msgcat::mcset sv "All Files" "Samtliga filer". ::msgcat::mcset sv "Application Error" "Programfel". ::msgcat::mcset sv "&Blue" "&Bl\u00e5". ::msgcat::mcset sv "Cancel" "Avbryt". ::msgcat::mcset sv "&Cancel" "&Avbryt". ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.". ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp". ::msgcat::mcset sv "Cl&ear" "&Radera". ::msgcat::mcset sv "&Clear Console" "&Radera konsollen". ::msgcat::mcset sv "Color" "F\u00e4rg". ::msgcat::mcset sv "Console" "Konsoll". ::msgcat::mcset sv "&Copy" "&Kopiera". ::msgcat::mcset sv "Cu&t" "Klipp u&t". ::msgcat::mcset sv "&Delete" "&Radera". ::msgcat::mcset sv "Details >>" "Detaljer >>". ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mappen \"%1\$s\" finns

C:\ProgramData\assignee\tk\obsolete.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5594
Entropy (8bit):	4.9941618573215525
Encrypted:	false
SSDEEP:	96:oz4CrtmsXVwM3Er4VAEQ93NZB1o+IFF5ZYi4GUoLf33yLLddzA:oUCrtmsFREEs999o7FF5ZYi4GjLfS/d2
MD5:	7763C90F811620A6C1F0A36BAF9B89CA
SHA1:	30E24595DD683E470FE9F12814D27D6D266B511E
SHA-256:	F6929A5E0D18BC4C6666206C63AC4AAA66EDC4B9F456DFC083300CFA95A44BCD
SHA-512:	2E2887392C67D05EA85DB2E6BFD4AA27779BC82D3B607A7DD221A99EFF0D2A21A6BA47A4F2D2CDFC7CFECD7E93B2B38064C4D5A51406471AE142EC9CC71F5C48
Malicious:	false
Preview:	# obsolete.tcl --.#.# This file contains obsolete procedures that people really shouldn't.# be using anymore, but which are kept around for backward compatibility..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# The procedures below are here strictly for backward compatibility with.# Tk version 3.6 and earlier. The procedures are no longer needed, so.# they are no-ops. You should not use these procedures anymore, since.# they may be removed in some future release...proc tk_menuBar args {}.proc tk_bindForTraversal args {}..# ::tk::classic::restore --.#.# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic.# Tk widgets..#.# The value following an 'option add' call is the new 8.5 value..#.namespace eval ::tk::classic {. # This may need to be adjusted for some windo

C:\ProgramData\assignee\tk\optMenu.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.733749898743743
Encrypted:	false
SSDEEP:	48:k2hguC4Zxk+Z0cIWR3afbR1EIC+KtVa+6WX13jZQl9:k6T9N3atqIkeS9FQD
MD5:	D17FE676A057F373B44C9197114F5A69
SHA1:	9745C83EEC8565602F8D74610424848009FFA670
SHA-256:	76DBDBF9216678D48D1640F8FD1E278E7140482E1CAC7680127A9A425CC61DEE
SHA-512:	FF7D9EB64D4367BB11C567E64837CB1DAAA9BE0C8A498CAD00BF63AF45C1826632BC3A09E65D6F51B26EBF2D07285802813ED55C5D697460FC95AF30A943EF8F
Malicious:	false
Preview:	# optMenu.tcl --.#.# This file defines the procedure tk_optionMenu, which creates.# an option button and its associated menu..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_optionMenu --.# This procedure creates an option button named $w and an associated.# menu. Together they provide the functionality of Motif option menus:.# they can be used to select one of many values, and the current value.# appears in the global variable varName, as well as in the text of.# the option menubutton. The name of the menu is returned as the.# procedure's result, so that the caller can use it to change configuration.# options on the menu or otherwise manipulate it..#.# Arguments:.# w -...The name to use for the menubutton..# varName -..Global variable to hold the currently selected value..# first

C:\ProgramData\assignee\tk\palette.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7928
Entropy (8bit):	4.906784880797114
Encrypted:	false
SSDEEP:	192:ZUW5yUd51URCJWgWWWuWVWMKoDOdn6jLDlJymGH91QOWJCy3XZQRr:ZLXaCI3dFU3Pdn6P69WJor
MD5:	B8DFD9C123F183300ED22E95BAC39BAA
SHA1:	A31D7C80753FA99BB7C0493C2AF983C106364662
SHA-256:	E0FFFD19D0B048F22E7B6187A43642D4E66749499A87B2716CB9B394D5E09C2D
SHA-512:	4601DF3C5D5F8AB01C0CEA53D4E75B71FD39ACF40220EDDF4FE477BF6A59AE06901559C4BC66D73A7D7DB1B30274B0476FFB2D8A220E327F4B7BC022B92FE84F
Malicious:	false
Preview:	# palette.tcl --.#.# This file contains procedures that change the color palette used.# by Tk..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_setPalette --.# Changes the default color scheme for a Tk application by setting.# default colors in the option database and by modifying all of the.# color options for existing widgets that have the default value..#.# Arguments:.# The arguments consist of either a single color name, which.# will be used as the new background color (all other colors will.# be computed from this) or an even number of values consisting of.# option names and values. The name for an option is the one used.# for the option database, such as activeForeground, not -activeforeground...proc ::tk_setPalette {args} {. if {[winfo depth .] == 1} {..# Just return on monochrome displays, otherwise errors will occur..return. }.

C:\ProgramData\assignee\tk\panedwindow.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5176
Entropy (8bit):	4.933519639131517
Encrypted:	false
SSDEEP:	96:PmpWHrga3awUrH6kdX3pBz6tkm71cHXYV23EmkiYlgfY8:+pWHrP36r6kJ3pBetkm6HXVUmPYlgfY8
MD5:	2DA0A23CC9D6FD970FE00915EA39D8A2
SHA1:	DFE3DC663C19E9A50526A513043D2393869D8F90
SHA-256:	4ADF738B17691489C71C4B9D9A64B12961ADA8667B81856F7ADBC61DFFEADF29
SHA-512:	B458F3D391DF9522D4E7EAE8640AF308B4209CE0D64FD490BFC0177FDE970192295C1EA7229CE36D14FC3E582C7649460B8B7B0214E0FF5629B2B430A99307D4
Malicious:	false
Preview:	# panedwindow.tcl --.#.# This file defines the default bindings for Tk panedwindow widgets and.# provides procedures that help in implementing those bindings...bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }.bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }..bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }.bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }..bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}.bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}..bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }..bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }..# Initialize namespace.namespace eval ::tk::panedwindow {}..# ::tk::panedwindow::MarkSash --.#.# Handle marking the correct sash for possible dragging.#.# Arguments:.# w..the widget.# x..widget local x coord.# y..widget local y coord.# proxy.whether this should be a prox

C:\ProgramData\assignee\tk\pkgIndex.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	370
Entropy (8bit):	5.011442925256698
Encrypted:	false
SSDEEP:	6:Cjtl17nwFQRVyDBc6ynID/cL4RpncleXN17MQ9P8IBIQ084rof7MQ9P8IBIQem4:ot7rwQGDO6LYZlifBIUQkfBIFV
MD5:	0247EF2C621A6B9C2B0A44F424F72C2E
SHA1:	2F2F5C122E0BA8D08D8867DE9A48EAF1ED031600
SHA-256:	EC8C5C7AA30023554124CAEC8BE87D8EA0FF27DE63A729182C00A51DEA2247B3
SHA-512:	843DECA657E4BB8D75046EF54EF6321C5EDEFBD65F8F2A824B96991285326ACDBE9B6C29C859AFDC20B68D9CB55DE4D2CCF81703C2F49DED2667A6F7396782F4
Malicious:	false
Preview:	if {[catch {package present Tcl 8.6.1}]} { return }..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...\|\| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.1 [list load [file join $dir .. .. bin libtk8.6.dll] Tk]..} else {.. package ifneeded Tk 8.6.1 [list load [file join $dir .. .. bin tk86t.dll] Tk]..}..

C:\ProgramData\assignee\tk\safetk.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	7381
Entropy (8bit):	4.833263771361282
Encrypted:	false
SSDEEP:	192:keEoaa0QfsimXZrjpgj47e5QeO9uMfUKvLAN6Zo:keEoRHsiWddgkoiUeG
MD5:	EFC567E407C48BF2BE4E09CB18DEFC11
SHA1:	EDEDB6776963B7D629C6ACE9440D24EB78DEA878
SHA-256:	9708F5A1E81E1C3FEAF189020105BE28D27AA8808FF9FB2DCCA040500CF2642A
SHA-512:	BDA5F92BD2F7B9CD29C5A732EC77A71291778A0EC3EABE81575C55DE3E207F663BA28DA4C95174045A74EFFF71B95D907C9D056BAA9E585E6F6DC14A133760BC
Malicious:	false
Preview:	# safetk.tcl --.#.# Support procs to use Tk in safe interpreters..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# see safetk.n for documentation..#.#.# Note: It is now ok to let untrusted code being executed.# between the creation of the interp and the actual loading.# of Tk in that interp because the C side Tk_Init will.# now look up the master interp and ask its safe::TkInit.# for the actual parameters to use for it's initialization (if allowed),.# not relying on the slave state..#..# We use opt (optional arguments parsing).package require opt 0.4.1;..namespace eval ::safe {.. # counter for safe toplevels. variable tkSafeId 0.}..#.# tkInterpInit : prepare the slave interpreter for tk loading.# most of the real job is done by loadTk.# returns the slave name (tkInterpInit does).#.proc ::safe::tkInterpIni

C:\ProgramData\assignee\tk\scale.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7639
Entropy (8bit):	4.952427588064212
Encrypted:	false
SSDEEP:	192:q1xTLI9LUAp8cZIQ+Umuy9vYE2dLTaFwHZeABypyTtB:HUN1Umn2dKWHIpCB
MD5:	CE2221A1B9DC6393C5ABBDA4826E2FD3
SHA1:	E7986224059C79FC8EB3EC22588394A368A39DE0
SHA-256:	090C31CDED1E846BB81D1F04D18E3400D0EAF0F4323E8497FF0FEB80E7D73900
SHA-512:	4AAB1A9515F12FD1387D3CFC9AA411B5E130725B159644EE8C8B6EF94B8FAE19146F69551358D3753C71920D02AF57788727F7C766A2389A8A0447B1D0A2C9D5
Malicious:	false
Preview:	# scale.tcl --.#.# This file defines the default bindings for Tk scale widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for entries..#-------------------------------------------------------------------------..# Standard Motif bindings:..bind Scale <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. tk::ScaleActivate %W %x %y.}.bind Scale <Motion> {. tk::ScaleActivate %W %x %y.}.bind Scale <Leave> {. if {$tk_strictMotif} {..%W configure -activebackground $tk::Priv(activeBg). }.

C:\ProgramData\assignee\tk\scrlbar.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12434
Entropy (8bit):	5.023957867370277
Encrypted:	false
SSDEEP:	192:AJVS+eV9fKbB5rpQQtfJMZqSwiXEfY4yhIa7yLIVNpIgdWmDN1gFBA:Nf4TGOfmkSwORVqaGcV4q7CBA
MD5:	9B2FA186839011D0AACAA6148FEB5230
SHA1:	3AE0DC3381EF55B950BB69F0A5E365D675B5DC80
SHA-256:	1B9633B649B95A05641D5A86D197612F1752466F90BEF1D3D13338E330891A44
SHA-512:	81CB41F9945EE93B47A6FE4DFA042323C75B1293228CFCE9634406F9E462CE021B99C158C47E0DC2B04D9CBC97DE32AECF821BF361F4C186BB8BB80E86A122AF
Malicious:	false
Preview:	# scrlbar.tcl --.#.# This file defines the default bindings for Tk scrollbar widgets..# It also provides procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for scrollbars..#-------------------------------------------------------------------------..# Standard Motif bindings:.if {[tk windowingsystem] eq "x11"} {..bind Scrollbar <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. %W activate [%W identify %x %y].}.bind Scrollbar <Motion> {. %W activate [%W identify %x %y].}..# The "info exists" command in the follo

C:\ProgramData\assignee\tk\spinbox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14821
Entropy (8bit):	5.026254364614214
Encrypted:	false
SSDEEP:	192:aR1uvx3VYxRrclOniQ14Yvg3bbVFMiop9Yp65uaMY+c6RhO1ON6Qb4qRiZ0NPd9G:Mud3XVF6pQ65/YRhO46qz8wdEt
MD5:	9C350DA2115F3220DD1E1C33685B3F83
SHA1:	BCAC55CBFB4C37084BCA11E04FBFC9B146D4AE05
SHA-256:	78DC6F17D3FB3A6112AEA69F448F59B3B339ADD6A24AE94D6F4873B43DA56F40
SHA-512:	CB7106857B0539B7226B6C32983C36F6B5B9BEBDC01AF1629784D7C995A462816459C5C19B76B9C02335B199ABD0C11F9A8486F43413F204BCC92B2D2A7FC524
Malicious:	false
Preview:	# spinbox.tcl --.#.# This file defines the default bindings for Tk spinbox widgets and provides.# procedures that help in implementing those bindings. The spinbox builds.# off the entry widget, so it can reuse Entry bindings and procedures..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1999-2000 Jeffrey Hobbs.# Copyright (c) 2000 Ajuba Solutions.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a

C:\ProgramData\assignee\tk\tclIndex

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20270
Entropy (8bit):	4.749624735829406
Encrypted:	false
SSDEEP:	384:edtm3fv2ZzffGIgowSDxD7n2s7AcBnaUuFyLWFot5gzSG3k96vNTWuoJnfOvWhbk:eds3fv2ZzffGIgowSDxD7nd7AcBnahFN
MD5:	4AD192C43972A6A4834D1D5A7C511750
SHA1:	09CA39647AA1C14DB16014055E48A9B0237639BA
SHA-256:	8E8ECECFD6046FE413F37A91933EEA086E31959B3FBEB127AFDD05CD9141BE9A
SHA-512:	287FAADBC6F65FCC3EA9C1EC10B190712BB36A06D28E59F8D268EA585B4E6B13494BA111DFF6AC2EBF998578999C9C36965C714510FC21A9ACB65FF9B75097CB
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]].set auto_index(::tk::ButtonAutoInvoke) [list source [file join

C:\ProgramData\assignee\tk\tearoff.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5143
Entropy (8bit):	4.671801205676465
Encrypted:	false
SSDEEP:	96:MgPXEnPQcTtD7zxeHK7ijhgdhAhbbjymL/KK2pLQY4QYNHL43IwzS6ejW:MgPUnPtTtFeqmjhgdhIbbjymL/KKeLQY
MD5:	405AB0EA001287D3304372EC6005E67F
SHA1:	159EBB2B84CABC16EDDB9B5335F2AE2043F46AF7
SHA-256:	CE7B3E10B24C14000B8BDD85B2F5B949B57122467C579B8DA2762AA7CFD9695C
SHA-512:	845ABE6D27D91F2525C513A57E9C001E71BB11CF0E4031B83F57FC54D1C6F941A8B28CA83428125173C7F2A7840214E9DAEA2BB2982C6C232D5DC6648A128452
Malicious:	false
Preview:	# tearoff.tcl --.#.# This file contains procedures that implement tear-off menus..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk::TearoffMenu --.# Given the name of a menu, this procedure creates a torn-off menu.# that is identical to the given menu (including nested submenus)..# The new torn-off menu exists as a toplevel window managed by the.# window manager. The return value is the name of the new menu..# The window is created at the point specified by x and y.#.# Arguments:.# w -...The menu to be torn-off (duplicated)..# x -...x coordinate where window is created.# y -...y coordinate where window is created..proc ::tk::TearOffMenu {w {x 0} {y 0}} {. # Find a unique name to use for the torn-off menu. Find the first. # ancestor of w that is a toplevel but not a menu,

C:\ProgramData\assignee\tk\text.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31575
Entropy (8bit):	4.922493146606495
Encrypted:	false
SSDEEP:	384:ThCXGSWlNGbXBFFRzGa4UNKEFx8wredko/gVVFaO/9bembFWaHnla98ffJ2qiPbd:TBNGtF6+Ndyy4Ona98ffJAAlde
MD5:	2F3AE20EADB35D5E92192B7366ABC9A1
SHA1:	A6C9901D31544B64E62DB8C581CE3EFF92A5A0F8
SHA-256:	4C65254A8B0B5E656C6537AC159046DBFE0305D3D4B171E38D4DA56E2B11F5B6
SHA-512:	C2CBEE19A95A87C678101528E57060DAA3C7E72E72591FF1A6ABC8005AC19725E973241A50BF18DB99A28DFFFE358AA9BE9EBA04A53238C7234187C2FB540DD1
Malicious:	false
Preview:	# text.tcl --.#.# This file defines the default bindings for Tk text widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of ::tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# char -..Character position on the line; kept in order.#...to allow moving up or down past short lines while.#...still remembering the desired position..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for exampl

C:\ProgramData\assignee\tk\tk.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	23216
Entropy (8bit):	5.095537829794799
Encrypted:	false
SSDEEP:	384:MOUlIQ7ylH462gngqeObubqLwvoGah0QSA4vLGG3sBxdCdPAWD+g190K5TzuSW8E:MOiIQulHokh0Qzc/cBxdCD+g1b7+
MD5:	89722A6039BC3115077B5A13DAA1CFCD
SHA1:	E835BD1098EAD86F2FEB380DDDAA555F08725908
SHA-256:	CBC1654273F59C00EA6C723B4C00357638B0935940F937841BE1E2E58725C3BD
SHA-512:	5DD3946B59EDF32DF32E5E93CAD269BFF7E1FABC649781B8548D919BF60DDEF57F85EDA116BC70A58ACF81BA3087AE77C3F398EC6CAF16D6495F8513EF2EF57C
Malicious:	false
Preview:	# tk.tcl --.#.# Initialization script normally executed in the interpreter for each Tk-based.# application. Arranges class bindings for widgets..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...# Insist on running with compatible version of Tcl.package require Tcl 8.6.# Verify that we have Tk binary and script components from the same release.package require -exact Tk 8.6.1...# Create a ::tk namespace.namespace eval ::tk {. # Set up the msgcat commands. namespace eval msgcat {..namespace export mc mcmax. if {[interp issafe] \|\| [catch {package require msgcat}]} {. # The msgcat package is not available. Supply our own. # minimal replacement.. proc mc {src args} {. tailcall format

C:\ProgramData\assignee\tk\tkfbox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38137
Entropy (8bit):	5.144561174265551
Encrypted:	false
SSDEEP:	384:a6NFLvIIaE2wCpxQYt/rJTkA3NN5YAGnk1cmgHZZgkO0Z6INfdpsaUpWz8ZlhL5M:akJ2wKhXuNzClMGH87f12VS
MD5:	33C9E792E5951B0831CFD90D8BB4F6BF
SHA1:	82ECD5AB09DB01E3FC3767E44C921DEC0F681869
SHA-256:	3612717985EE0B17A0B559B2F77C7F355497F3E03815BB5EB0BAC07DF41C53EE
SHA-512:	C159DE3151E9DA6E27143A4692D275814F1AA5374DD1400B28DA342E681358432674A665F01512C16E48CD5585049BEB69CA72DC1610BE242734916522D1B5E7
Malicious:	false
Preview:	# tkfbox.tcl --.#.#.Implements the "TK" standard file selection dialog box. This dialog.#.box is used on the Unix platforms whenever the tk_strictMotif flag is.#.not set..#.#.The "TK" standard file selection dialog box is similar to the file.#.selection dialog box on Win95(TM). The user can navigate the.#.directories by clicking on the folder icons or by selecting the.#."Directory" option menu. The user can select files by clicking on the.#.file icons or by entering a filename in the "Filename:" entry..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {. namespace import -force ::tk::msgcat::*. variable showHiddenBtn 0. variable showHiddenVar 1.. # Create the images if they did not already exist.. if {![info exists ::tk::Priv(updirImage)]} {..set ::tk::Priv(updirImage)

C:\ProgramData\assignee\tk\ttk\altTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	4.893964295093112
Encrypted:	false
SSDEEP:	48:xICAIX5RupDdMrwuQb8qRZRK9FVGQJFVGQuxzUFIG0usf2kGKQH+n5dvW88L+iSo:hXoFADfVta9DY
MD5:	909F379DB70A6072D49D0B48D07A32FD
SHA1:	D6E0323EB4549327E5A4722015448A80AC3A99E4
SHA-256:	83D9A5889205EE8EAE23E262F15187EEBFE19375BC6C9D464E570CD5FD1F5B2C
SHA-512:	9ECAE6EF7EC784B5104ADFA2EBBB1F33116470BD3A0346D04D945A3A20C569EC052C28BCF4E914F4264D0CA80C27AD5FB43078CFE38318203E5698B6B84D13CC
Malicious:	false
Preview:	#.# Ttk widget set: Alternate theme.#..namespace eval ttk::theme::alt {.. variable colors. array set colors {..-frame .."#d9d9d9"..-window.."#ffffff"..-darker ."#c3c3c3"..-border.."#414141"..-activebg ."#ececec"..-disabledfg."#a3a3a3"..-selectbg."#4a6984"..-selectfg."#ffffff". }.. ttk::style theme settings alt {...ttk::style configure "." \.. -background .$colors(-frame) \.. -foreground .black \.. -troughcolor.$colors(-darker) \.. -bordercolor.$colors(-border) \.. -selectbackground .$colors(-selectbg) \.. -selectforeground .$colors(-selectfg) \.. -font ..TkDefaultFont \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)] ;..ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -padding "1 1" \.. -relief raised -shiftrelief 1 \.. -highlightthickness 1 -highligh

C:\ProgramData\assignee\tk\ttk\aquaTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2001
Entropy (8bit):	4.976834248247965
Encrypted:	false
SSDEEP:	24:mjP8dTLsQdWyrF4srKp7UPl7UzT7Ub0aeKgNIii6jOMj0b3M+t2bUuERG6dup+Kx:tdlBlblITKleKgNX1gPc+JFzVcX0jX4
MD5:	288F477ED1FBFBB02CF9E35B23878EDB
SHA1:	BBC4AD4A502D52DEDB40D44BBFCB7DA7897BBDC4
SHA-256:	C2D4B12BD82C056B3A1B5C655FFC2D85208DF74C3FA486EF64AADBC64A021F95
SHA-512:	CE28CCFE9F7E16AC5B9E5C8C8A0445ECBAE82493F8A5C779B4FA4E2FD9BA1F7E7D4A644AC6283A104AADE2EF1F5CFAC676B52CC5D700ACF5DF77653006FB9A4B
Malicious:	false
Preview:	#.# Aqua theme (OSX native look and feel).#..namespace eval ttk::theme::aqua {. ttk::style theme settings aqua {...ttk::style configure . \.. -font TkDefaultFont \.. -background systemWindowBody \.. -foreground systemModelessDialogActiveText \.. -selectbackground systemHighlight \.. -selectforeground systemModelessDialogActiveText \.. -selectborderwidth 0 \.. -insertwidth 1...ttk::style map . \.. -foreground {disabled systemModelessDialogInactiveText... background systemModelessDialogInactiveText} \.. -selectbackground {background systemHighlightSecondary... !focus systemHighlightSecondary} \.. -selectforeground {background systemModelessDialogInactiveText... !focus systemDialogActiveText}...# Workaround for #1100117:..# Actually, on Aqua we probably shouldn't stipple images in..# disabled buttons even if it did work.....ttk::style configure . -stipple {}...ttk::style configure TButton -anchor center -width -6..ttk::style configure Toolbutton -

C:\ProgramData\assignee\tk\ttk\button.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	4.8919006418640265
Encrypted:	false
SSDEEP:	48:hpNRZ/rtWkRMC0ScGHsAEfKPi7K1MFNQ6z4Dvh8niT6CUI+SfRHThp:DNRZzse1cGH3UvKmFNQ6z2hT6CUI+4Hb
MD5:	EA7CF40852AFD55FFDA9DB29A0E11322
SHA1:	B7B42FAC93E250B54EB76D95048AC3132B10E6D8
SHA-256:	391B6E333D16497C4B538A7BDB5B16EF11359B6E3B508D470C6E3703488E3B4D
SHA-512:	123D78D6AC34AF4833D05814220757DCCF2A9AF4761FE67A8FE5F67A0D258B3C8D86ED346176FFB936AB3717CFD75B4FAB7373F7853D44FA356BE6E3A75E51B9
Malicious:	false
Preview:	#.# Bindings for Buttons, Checkbuttons, and Radiobuttons..#.# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed".# state; widgets remain "active" if the pointer is dragged out..# This doesn't seem to be conventional, but it's a nice way.# to provide extra feedback while the grab is active..# (If the button is released off the widget, the grab deactivates and.# we get a <Leave> event then, which turns off the "active" state).#.# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are .# delivered to the widget which received the initial <ButtonPress>.# event. However, Tk [grab]s (#1223103) and menu interactions.# (#1222605) can interfere with this. To guard against spurious.# <Button1-Enter> events, the <Button1-Enter> binding only sets.# the pressed state if the button is currently active..#..namespace eval ttk::button {}..bind TButton <Enter> ..{ %W instate !disabled {%W state active} }.bind TButton <Leave>..{ %W state !active }.bind TButton <Key-space>.{ ttk:

C:\ProgramData\assignee\tk\ttk\clamTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4261
Entropy (8bit):	4.849408646746382
Encrypted:	false
SSDEEP:	48:9NlU3tCKW3PiAu4UZQsk+EBSucCtCqM368CtTU/+RR8Rf/sY2+rF+xzFjueNoDKM:SHjO7uCkqM3JCNU/RrVb
MD5:	F2EEFF6F288437CA0DA802F6844A414C
SHA1:	61A722FFDA5F5FBA842F673AC3B95062452567C2
SHA-256:	4CC2DC26FE379F69CE46A73ABFBABEB9DD5509C41616E1D5A8395BE94170C62C
SHA-512:	23DA52FA6E8046CF383BEFD338B96550DE253983EEB3F29F183AD4BFCDBDA730B93ED9C6F0EAE3CEE816FF978FD77DBBC8B1C714B18120B718EB017D37BCB0D7
Malicious:	false
Preview:	#.# "Clam" theme..#.# Inspired by the XFCE family of Gnome themes..#..namespace eval ttk::theme::clam {. variable colors . array set colors {..-disabledfg."#999999"..-frame ."#dcdad5"..-window ."#ffffff"..-dark.."#cfcdc8"..-darker ."#bab5ab"..-darkest."#9e9a91"..-lighter."#eeebe7"..-lightest ."#ffffff"..-selectbg."#4a6984"..-selectfg."#ffffff". }.. ttk::style theme settings clam {...ttk::style configure "." \.. -background $colors(-frame) \.. -foreground black \.. -bordercolor $colors(-darkest) \.. -darkcolor $colors(-dark) \.. -lightcolor $colors(-lighter) \.. -troughcolor $colors(-darker) \.. -selectbackground $colors(-selectbg) \.. -selectforeground $colors(-selectfg) \.. -selectborderwidth 0 \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -background [list disabled $colors(-frame) \.... active $colors(-lighter)] \.. -foreground [list disabled $colors(-disabledfg)] \.. -selectbackground [list !focus $colors(-darkest

C:\ProgramData\assignee\tk\ttk\classicTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3520
Entropy (8bit):	4.904850162459333
Encrypted:	false
SSDEEP:	48:yAJZjsTMw9EEy6kvzuVubguxjFVGQJFVGQuxzUFIGQutK2MRvD7J+iSVaND2kG/h:yAJZ8MhJiV8fVIV7Urt
MD5:	8071763DA22437B3DBBA8276DFCB31D9
SHA1:	FBC8DC3198F49A6915A8AB6B4A388450B71A998D
SHA-256:	92F7BEFAD42820E988806601DCA49719FA651C88B8767B3347B13706EE3C17F9
SHA-512:	E49B2DDBA1FC6E53BAA5B39AAAD496B6931562CB135F8EAB495661229FAD7085CEBDEA28221F3D1927B96012E3B3AD1ECD41A36E42AD672628F9FD2C755C07D4
Malicious:	false
Preview:	#.# "classic" Tk theme..#.# Implements Tk's traditional Motif-like look and feel..#..namespace eval ttk::theme::classic {.. variable colors; array set colors {..-frame.."#d9d9d9"..-window.."#ffffff"..-activebg."#ececec"..-troughbg."#c3c3c3"..-selectbg."#c3c3c3"..-selectfg."#000000"..-disabledfg."#a3a3a3"..-indicator."#b03060". }.. ttk::style theme settings classic {..ttk::style configure "." \.. -font..TkDefaultFont \.. -background..$colors(-frame) \.. -foreground..black \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -troughcolor.$colors(-troughbg) \.. -indicatorcolor.$colors(-frame) \.. -highlightcolor.$colors(-frame) \.. -highlightthickness.1 \.. -selectborderwidth.1 \.. -insertwidth.2 \.. ;...# To match pre-Xft X11 appearance, use:..#.ttk::style configure . -font {Helvetica 12 bold}...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)]..ttk::style map "." -

C:\ProgramData\assignee\tk\ttk\combobox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12394
Entropy (8bit):	5.023972528049574
Encrypted:	false
SSDEEP:	192:l/9k9hqpFXQN9lQt3NvnIW+KYNbrulkL90t98VrQETczIT9QeSaQjJI1/P0lcLrM:BhlLtVL5MmIRK
MD5:	CF03B3F5E179F5032AFB6355905636A0
SHA1:	D4C7EAC03B8ECAD6A94E7A9EB7BBFF562768ED3C
SHA-256:	30BB473C0471F4D015FCF4B51044A026520D53927F61F3D514EA53B8AF0BCF67
SHA-512:	DAE0DDB29D6E1E38EF65C70001BF836F1A12CFA9246658A87DFBBE02F6CB949C00F0A2ADBCA6C2200D583F2AB71F3E6BAB02C754801C0EAEEB2880D2ACD91122
Malicious:	false
Preview:	#.# Combobox bindings..#.# <<NOTE-WM-TRANSIENT>>:.#.#.Need to set [wm transient] just before mapping the popdown.#.instead of when it's created, in case a containing frame.#.has been reparented [#1818441]..#.#.On Windows: setting [wm transient] prevents the parent.#.toplevel from becoming inactive when the popdown is posted.#.(Tk 8.4.8+).#.#.On X11: WM_TRANSIENT_FOR on override-redirect windows.#.may be used by compositing managers and by EWMH-aware.#.window managers (even though the older ICCCM spec says.#.it's meaningless)..#.#.On OSX: [wm transient] does utterly the wrong thing..#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]..#.The "noActivates" attribute prevents the parent toplevel.#.from deactivating when the popdown is posted, and is also.#.necessary for "help" windows to receive mouse events..#."hideOnSuspend" makes the popdown disappear (resp. reappear).#.when the parent toplevel is deactivated (resp. reactivated)..#.(see [#1814778]). Also set [wm resiz

C:\ProgramData\assignee\tk\ttk\cursors.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4007
Entropy (8bit):	4.827479665184231
Encrypted:	false
SSDEEP:	48:xtIni2E1nmuVoLlTxG6qVXvDiPOaCkhxKLbqnJ2RLWumgMJVZlZPDjsfMh8vIviX:sn+myoLBxG3laOqJlZT3rkdSVOJm0
MD5:	74596004DFDBF2ECF6AF9C851156415D
SHA1:	933318C992B705BF9F8511621B4458ECB8772788
SHA-256:	7BDFFA1C2692C5D1CF67B518F9ACB32FA4B4D9936ED076F4DB835943BC1A00D6
SHA-512:	0D600B21DB67BF9DADBDD49559573078EFB41E473E94124AC4D2551BC10EC764846DC1F7674DAA79F8D2A8AEB4CA27A5E11C2F30EDE47E3ECEE77D60D7842262
Malicious:	false
Preview:	#.# Map symbolic cursor names to platform-appropriate cursors..#.# The following cursors are defined:.#.#.standard.-- default cursor for most controls.#.""..-- inherit cursor from parent window.#.none..-- no cursor.#.#.text..-- editable widgets (entry, text).#.link..-- hyperlinks within text.#.crosshair.-- graphic selection, fine control.#.busy..-- operation in progress.#.forbidden.-- action not allowed.#.#.hresize..-- horizontal resizing.#.vresize..-- vertical resizing.#.# Also resize cursors for each of the compass points,.# {nw,n,ne,w,e,sw,s,se}resize..#.# Platform notes:.#.# Windows doesn't distinguish resizing at the 8 compass points,.# only horizontal, vertical, and the two diagonals..#.# OSX doesn't have resize cursors for nw, ne, sw, or se corners..# We use the Tk-defined X11 fallbacks for these..#.# X11 doesn't have a "forbidden" cursor (usually a slashed circle);.# "pirate" seems to be the conventional cursor for this purpose..#.# Windows has an IDC_HELP cursor, but it's not

C:\ProgramData\assignee\tk\ttk\defaults.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3684
Entropy (8bit):	4.893081856580555
Encrypted:	false
SSDEEP:	48:EyE4jTUC5zu/cbtCBRCbxcFfFIGQJFIGQkUFIG0uI+x3ouPcW88nKI+ifVaVCflC:nE+Uoi/hjB1+Atj/bf30QOdt
MD5:	79F1C9D16EC1B66762E82B73113C3A12
SHA1:	51544CECBDF72CE799A80373BE727A8AB9CCA34F
SHA-256:	436CA9AD206F26DF3B4F665AB2EB60A24BB833699172EE91F5A1ADAAFAC9951F
SHA-512:	7BAD8EBFF17E18C9BD7F336AEEDFAE67DB25303B6F7948362AF5C93F7945337592803A22CF676C25E8879F097A7DAEF9EA7A8036FF76723E0720CE7EB9ED46B8
Malicious:	false
Preview:	#.# Settings for default theme..#..namespace eval ttk::theme::default {. variable colors. array set colors {..-frame.."#d9d9d9"..-foreground."#000000"..-window.."#ffffff"..-text ."#000000"..-activebg."#ececec"..-selectbg."#4a6984"..-selectfg."#ffffff"..-darker ."#c3c3c3"..-disabledfg."#a3a3a3"..-indicator."#4a6984". }.. ttk::style theme settings default {...ttk::style configure "." \.. -borderwidth .1 \.. -background .$colors(-frame) \.. -foreground .$colors(-foreground) \.. -troughcolor .$colors(-darker) \.. -font ..TkDefaultFont \.. -selectborderwidth.1 \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -insertwidth .1 \.. -indicatordiameter.10 \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)]..ttk::style map "." -foreground \.. [list disabled $colors(-disabledfg)]...ttk::style configure TButton \.. -anchor center -padding "3 3" -width -9 \..

C:\ProgramData\assignee\tk\ttk\entry.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15889
Entropy (8bit):	4.970968191044437
Encrypted:	false
SSDEEP:	192:hRy3GLQk3UeoayTUXIQzNiQ2iEL8QmOhQVqknFoTOXyJtcC1JMuoafZxO252ExZJ:GVUXmiEyOFWiTOEtcC1v2252Ezp
MD5:	76AECBAD28BCA34368013AFB12F8297C
SHA1:	95A52943B60E085C37F21BCCE5A65E0FED62C9A5
SHA-256:	D3E7BABC44688E8539858C17FBE9995E28EA23D065B0C8C0509AC3BCCADFF766
SHA-512:	00D79569D56251E230ECD834AB4F598FCE066E7631DE7200C97BF2032BDB1709889895E4E8C314769FF17DE4E835E8799F84A272DCC83F8F56E12BD995D1AB58
Malicious:	false
Preview:	#.# DERIVED FROM: tk/library/entry.tcl r1.22.#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 2004, Joe English.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ttk {. namespace eval entry {..variable State...set State(x) 0..set State(selectMode) char..set State(anchor) 0..set State(scanX) 0..set State(scanIndex) 0..set State(scanMoved) 0...# Button-2 scan speed is (scanNum/scanDen) characters..# per pixel of mouse movement...# The standard Tk entry widget uses the equivalent of..# scanNum = 10, scanDen = average character width...# I don't know why that was chosen...#..set State(scanNum) 1..set State(scanDen) 1..set State(deadband) 3.;# #pixels for mouse-moved deadband.. }.}..### Option database settings..#.option add *TEntry.cursor [ttk::cursor text]..### Bindings..#.# Removed the following

C:\ProgramData\assignee\tk\ttk\fonts.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5571
Entropy (8bit):	4.955044015248668
Encrypted:	false
SSDEEP:	96:Nduphbitcq1Zs/ZrBiZy227wLkdhetOstWGbRafkeHH+4:3CheHvsbiZyDWJbRa3+4
MD5:	5EBF9DC98E0A81A75A50B395E42A48BC
SHA1:	CFDD5837F3B085F030F0BF79AEA7A78A5782AB1E
SHA-256:	0337EED499FF1D7A421D353B3E8483E523B454A338147B65AB1EEFD5E6280A5B
SHA-512:	2269EC5DA654C8B24F789B036C1BBBB74218066DF2C407E61B0F92ABE8B4B4EC6C52C6B8098DA6CF287DA7EABEB011905F01FB053F347E18510B72B24A45FCDE
Malicious:	false
Preview:	#.# Font specifications..#.# This file, [source]d at initialization time, sets up the following.# symbolic fonts based on the current platform:.#.# TkDefaultFont.-- default for GUI items not otherwise specified.# TkTextFont.-- font for user text (entry, listbox, others).# TkFixedFont.-- standard fixed width font.# TkHeadingFont.-- headings (column headings, etc).# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.).# TkTooltipFont.-- font to use for tooltip windows.# TkIconFont.-- font to use for icon captions.# TkMenuFont.-- used to use for menu items.#.# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation.# (On Windows and Mac OS X as of Oct 2007)..#.# +++ Platform notes:.#.# Windows:.#.The default system font changed from "MS Sans Serif" to "Tahoma".# .in Windows XP/Windows 2000..#.#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,.#.although many MS programs still use "MS Sans Serif 8".#.#.Should use SystemParametersInfo() inst

C:\ProgramData\assignee\tk\ttk\menubutton.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4886
Entropy (8bit):	4.8399606995889455
Encrypted:	false
SSDEEP:	96:1reigApQy38gaQJy+3nN+PN8JdN3OPqoK4J+wQCV7EkGxIaqc9ld9qtlWnITOZmd:hfbJvnN+PN8JdN3s64J+wQCPGxtqWrqf
MD5:	06F570587F05FC9E20E2E841A5DDB938
SHA1:	0E69C6AB9E03049592107BEDD37A9F9D45C7F139
SHA-256:	8E6958FBC899BAEB1942E0E56D3B8CF135409949FF249D9858C777922BAFBC58
SHA-512:	E150C38BDE8A5370212D456D125E3B6648DD0047AE3406C735D148E310D4CDEB8732EBA0B226C0E221BACF909D4BAB8104CCD6FDCAF5148E95AB7F389B14918F
Malicious:	false
Preview:	#.# Bindings for Menubuttons..#.# Menubuttons have three interaction modes:.#.# Pulldown: Press menubutton, drag over menu, release to activate menu entry.# Popdown: Click menubutton to post menu.# Keyboard: <Key-space> or accelerator key to post menu.#.# (In addition, when menu system is active, "dropdown" -- menu posts.# on mouse-over. Ttk menubuttons don't implement this)..#.# For keyboard and popdown mode, we hand off to tk_popup and let .# the built-in Tk bindings handle the rest of the interaction..#.# ON X11:.#.# Standard Tk menubuttons use a global grab on the menubutton..# This won't work for Ttk menubuttons in pulldown mode,.# since we need to process the final <ButtonRelease> event,.# and this might be delivered to the menu. So instead we.# rely on the passive grab that occurs on <ButtonPress> events,.# and transition to popdown mode when the mouse is released.# or dragged outside the menubutton..# .# ON WINDOWS:.#.# I'm not sure what the hell is going on here. [$menu pos

C:\ProgramData\assignee\tk\ttk\notebook.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5619
Entropy (8bit):	4.937953914483602
Encrypted:	false
SSDEEP:	96:d4tDJf49tzG809fhQAKWCgQOK/6PF+hEi8YYFSL+3FJVCj0QlK2kfJcQIni:d4tktzwfWngQOK/6PF+hDDYFNJVCj0Q2
MD5:	82C9DFC512E143DDA78F91436937D4DD
SHA1:	26ABC23C1E0C201A217E3CEA7A164171418973B0
SHA-256:	D1E5267CDE3D7BE408B4C94220F7E1833C9D452BB9BA3E194E12A5EB2F9ADB80
SHA-512:	A9D3C04AD67E0DC3F1C12F9E21EF28A61FA84DBF710313D4CA656BDF35DFBBFBA9C268C018004C1F5614DB3A1128025D795BC14B4FFFAA5603A5313199798D04
Malicious:	false
Preview:	#.# Bindings for TNotebook widget.#..namespace eval ttk::notebook {. variable TLNotebooks ;# See enableTraversal.}..bind TNotebook <ButtonPress-1>..{ ttk::notebook::Press %W %x %y }.bind TNotebook <Key-Right>..{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Key-Left>..{ ttk::notebook::CycleTab %W -1; break }.bind TNotebook <Control-Key-Tab>.{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Control-Shift-Key-Tab>.{ ttk::notebook::CycleTab %W -1; break }.catch {.bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }.}.bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }..# ActivateTab $nb $tab --.#.Select the specified tab and set focus..#.# Desired behavior:.#.+ take focus when reselecting the currently-selected tab;.#.+ keep focus if the notebook already has it;.#.+ otherwise set focus to the first traversable widget.#. in the newly-selected tab;.#.+ do not leave the focus in a deselected tab..#.proc ttk::notebook::ActivateTab {w tab} {.

C:\ProgramData\assignee\tk\ttk\panedwindow.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	4.916119835701688
Encrypted:	false
SSDEEP:	24:kfkVpfktNZz51kfkB6fkO/cfkyk2fkI4fkI1fkxUufkYfkEtNMiyHvyPHfk9tNZ5:0ZPhMiyHvyPQZNtiisZvUriZPaa+fdl
MD5:	A12915FA5CAF93E23518E9011200F5A4
SHA1:	A61F665A408C10419FB81001578D99B43D048720
SHA-256:	CE0053D637B580170938CF552B29AE890559B98EB28038C2F0A23A265DDEB273
SHA-512:	669E1D66F1223CCA6CEB120914D5D876BD3CF401EE4A46F35825361076F19C7341695596A7DBB00D6CFF4624666FB4E7A2D8E7108C3C56A12BDA7B04E99E6F9A
Malicious:	false
Preview:	#.# Bindings for ttk::panedwindow widget..#..namespace eval ttk::panedwindow {. variable State. array set State {..pressed 0. .pressX.-..pressY.-..sash .-..sashPos -. }.}..## Bindings:.#.bind TPanedwindow <ButtonPress-1> .{ ttk::panedwindow::Press %W %x %y }.bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }.bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }..bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }.# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>.bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }..## Sash movement:.#.proc ttk::panedwindow::Press {w x y} {. variable State.. set sash [$w identify $x $y]. if {$sash eq ""} {. .set State(pressed) 0..return. }. set State(pressed) .1. set State(pressX) .$x. set State(pressY) .$y. set State(sa

C:\ProgramData\assignee\tk\ttk\progress.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	4.7101709883442755
Encrypted:	false
SSDEEP:	24:o83oOUyNSiBj0oNA7h5EwIa2s0ImxamrNlUImyJDirNPpwWgJ:oMtS6j0eyEw0s02mhlU4khPp4J
MD5:	B0074341A4BDA36BCDFF3EBCAE39EB73
SHA1:	D070A01CC5A787249BC6DAD184B249C4DD37396A
SHA-256:	A9C34F595E547CE94EE65E27C415195D2B210653A9FFCFB39559C5E0FA9C06F8
SHA-512:	AF23563602886A648A42B03CC5485D84FCC094AB90B08DF5261434631B6C31CE38D83A3A60CC7820890C797F6C778D5B5EFF47671CE3EE4710AB14C6110DCC35
Malicious:	false
Preview:	#.# Ttk widget set: progress bar utilities..#..namespace eval ttk::progressbar {. variable Timers.;# Map: widget name -> after ID.}..# Autoincrement --.#.Periodic callback procedure for autoincrement mode.#.proc ttk::progressbar::Autoincrement {pb steptime stepsize} {. variable Timers.. if {![winfo exists $pb]} {. .# widget has been destroyed -- cancel timer..unset -nocomplain Timers($pb)..return. }.. set Timers($pb) [after $steptime \. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].. $pb step $stepsize.}..# ttk::progressbar::start --.#.Start autoincrement mode. Invoked by [$pb start] widget code..#.proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {. variable Timers. if {![info exists Timers($pb)]} {..Autoincrement $pb $steptime $stepsize. }.}..# ttk::progressbar::stop --.#.Cancel autoincrement mode. Invoked by [$pb stop] widget code..#.proc ttk::progressbar::stop {pb} {. variable Timers. if {[info exists Timers($pb

C:\ProgramData\assignee\tk\ttk\scale.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2698
Entropy (8bit):	4.7624002445430955
Encrypted:	false
SSDEEP:	48:6Zsdayx/HZtYRqucO6wEKyRtZt0TcKVqZ4TFZkPDMiNf:Wde/5tYRquMwEKyFt0TcKVG4TrkLMwf
MD5:	B41A9DF31924DEA36D69CB62891E8472
SHA1:	4C2877FBB210FDBBDE52EA8B5617F68AD2DF7B93
SHA-256:	25D0FE2B415292872EF7ACDB2DFA12D04C080B7F9B1C61F28C81AA2236180479
SHA-512:	A50DB6DA3D40D07610629DE45F06A438C6F2846324C3891C54C99074CFB7BEED329F27918C8A85BADB22C6B64740A2053B891F8E5D129D9B0A1FF103E7137D83
Malicious:	false
Preview:	# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# Bindings for the TScale widget..namespace eval ttk::scale {. variable State. array set State {..dragging 0. }.}..bind TScale <ButtonPress-1> { ttk::scale::Press %W %x %y }.bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-2> { ttk::scale::Jump %W %x %y }.bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-3> { ttk::scale::Jump %W %x %y }.bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }..## Keyboard navigation bindings:.#.bind TScale <<LineStart>> { %W set [%W cget -from] }.bind TScale <<LineEnd>> { %W set [%W cget -to] }..bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }.bind TScale <<PrevLine>> {

C:\ProgramData\assignee\tk\ttk\scrollbar.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3097
Entropy (8bit):	4.913511104649656
Encrypted:	false
SSDEEP:	96:OsSofRsvfH3Noo2kvrjnWG3Lcyst0Rhrdy:plcHdoorDjWEFeuTy
MD5:	93181DBE76EF9C39849A09242D6DF8C0
SHA1:	DE3B47AFC3E5371BF1CD0541790A9B78A97570AB
SHA-256:	5932043286A30A3CFFB2B6CE68CCDB9172A718F32926E25D3A962AE63CAD515C
SHA-512:	5C85284E063A5DE17F6CE432B3EF899D046A78725BD1F930229576BED1116C03A3EE0611B988E9903F47DA8F694483E5A76464450C48EB14622F6784004B8F7E
Malicious:	false
Preview:	#.# Bindings for TScrollbar widget.#..# Still don't have a working ttk::scrollbar under OSX -.# Swap in a [tk::scrollbar] on that platform,.# unless user specifies -class or -style..#.if {[tk windowingsystem] eq "aqua"} {. rename ::ttk::scrollbar ::ttk::_scrollbar. proc ttk::scrollbar {w args} {..set constructor ::tk::scrollbar..foreach {option _} $args {.. if {$option eq "-class" \|\| $option eq "-style"} {...set constructor ::ttk::_scrollbar...break.. }..}..return [$constructor $w {*}$args]. }.}..namespace eval ttk::scrollbar {. variable State. # State(xPress).--. # State(yPress).-- initial position of mouse at start of drag.. # State(first).-- value of -first at start of drag..}..bind TScrollbar <ButtonPress-1> .{ ttk::scrollbar::Press %W %x %y }.bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }.bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }..bind TScrollbar <ButtonPress-2> .{ ttk::scrollbar::Jump %W %x %y }.bind TScrollb

C:\ProgramData\assignee\tk\ttk\sizegrip.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	4.778050320627444
Encrypted:	false
SSDEEP:	48:KqL4L1BItZ3EZEhHR4vuRbMMie8GMW/H7vZZNQdqrYfy2nL+ZZvBb:KDhBIjHHRmiM1qvbnNQdqriyQIvB
MD5:	BD1F47CE81C8690462B050CED53A6817
SHA1:	318EB1F966A7E04E75F376D5D748E80A68E99A13
SHA-256:	ED31FA0B0D3438ACAD3384DDE1E562033E0D9A035E5056322DA219D6C4CBD912
SHA-512:	7BDF0438806A2962B553F9062077522BD03EED1088B7D66C652920786A10D19897F263C195AAA6E29023D9BC69C33BBEF189CE082A2DCD2611336448E5CBD87D
Malicious:	false
Preview:	#.# Sizegrip widget bindings..#.# Dragging a sizegrip widget resizes the containing toplevel..#.# NOTE: the sizegrip widget must be in the lower right hand corner..#..switch -- [tk windowingsystem] {. x11 -. win32 {..option add *TSizegrip.cursor [ttk::cursor seresize]. }. aqua {. .# Aqua sizegrips use default Arrow cursor.. }.}..namespace eval ttk::sizegrip {. variable State. array set State {..pressed .0..pressX ..0..pressY ..0..width ..0..height ..0..widthInc.1..heightInc.1. resizeX 1. resizeY 1..toplevel .{}. }.}..bind TSizegrip <ButtonPress-1> ..{ ttk::sizegrip::Press.%W %X %Y }.bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }.bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }..proc ttk::sizegrip::Press {W X Y} {. variable State.. if {[$W instate disabled]} { return }.. set top [winfo toplevel $W].. # If the toplevel is not resizable then bail. foreach {State(resizeX) State(resi

C:\ProgramData\assignee\tk\ttk\spinbox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4255
Entropy (8bit):	4.9576194953603006
Encrypted:	false
SSDEEP:	96:17n+wMf6/ocy2nO6lz+Ni2QQ0Q3LqSFLfhrxJSS3hQb:ln+wMOxVlaNi2QQ0QbdFLfhrxJzhQb
MD5:	86BCA3AB915C2774425B70420E499140
SHA1:	FD4798D79EEBA9CFFABCB2548068591DB531A716
SHA-256:	51F8A6C772648541684B48622FFE41B77871A185A8ACD11E9DEC9EC41D65D9CD
SHA-512:	659FB7E1631ED898E3C11670A04B953EB05CECB42A3C5EFBDD1BD97A7F99061920FD5DB3915476F224BB2C72358623E1B474B0FC3FBB7FD3734487B87A388FD7
Malicious:	false
Preview:	#.# ttk::spinbox bindings.#..namespace eval ttk::spinbox { }..### Spinbox bindings..#.# Duplicate the Entry bindings, override if needed:.#..ttk::copyBindings TEntry TSpinbox..bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }.bind TSpinbox <ButtonPress-1> ..{ ttk::spinbox::Press %W %x %y }.bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }.bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }.bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click..bind TSpinbox <KeyPress-Up>..{ event generate %W <<Increment>> }.bind TSpinbox <KeyPress-Down> ..{ event generate %W <<Decrement>> }..bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }.bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }..ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]..## Motion --.#.Sets cursor..#.proc ttk::spinbox::Motion {w x y} {. if { [$w identify $x $y] eq "textarea". && [$w instate {!readonly !disabled}]. } {..ttk::setCurso

C:\ProgramData\assignee\tk\ttk\treeview.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8859
Entropy (8bit):	4.859069301214814
Encrypted:	false
SSDEEP:	96:2Ou002WQZ4sNNxjKomA3xj9L/37NbbFqG4eeMxCSbk3TPMrngEibSB1GjwPBKsF0:ZWeZ5BDX+DsXibSQUMHLCGLdE2bZ
MD5:	A849BB347443F71BCCD36028F08813F6
SHA1:	5CE1C5E891F934612AF71348F4CE7D6A60C9399C
SHA-256:	3CADAEA517D5CBB1F2AE09F8F5CAEF7B7D0104E71C07BE7263D9AF158CE2699D
SHA-512:	4A8CE4043D221AEA26C569A050A21A874779123888A6CF08AACB4BEEC039D9A17EDA17109FD9115E79C1AE05DFD557DE774F692A46EFF37AECB081743DC53023
Malicious:	false
Preview:	#.# ttk::treeview widget bindings and utilities..#..namespace eval ttk::treeview {. variable State.. # Enter/Leave/Motion. #. set State(activeWidget) .{}. set State(activeHeading) .{}.. # Press/drag/release:. #. set State(pressMode) .none. set State(pressX)..0.. # For pressMode == "resize". set State(resizeColumn).#0.. # For pressmode == "heading". set State(heading) .{}.}..### Widget bindings..#..bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }.bind Treeview.<B1-Leave>..{ #nothing }.bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}.bind Treeview.<ButtonPress-1> .{ ttk::treeview::Press %W %x %y }.bind Treeview.<Double-ButtonPress-1> .{ ttk::treeview::DoubleClick %W %x %y }.bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }.bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }.bind Treeview .<KeyPress-Up> .{ ttk::treeview::Keynav %W up }.bind Treeview .<KeyPress-Down> .{ ttk::treeview::Keynav %

C:\ProgramData\assignee\tk\ttk\ttk.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4546
Entropy (8bit):	4.888987944406022
Encrypted:	false
SSDEEP:	96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
MD5:	E38B399865C45E49419C01FF2ADDCE75
SHA1:	F8A79CBC97A32622922D4A3A5694BCCB3F19DECB
SHA-256:	61BAA0268770F127394A006340D99CE831A1C7AD773181C0C13122F7D2C5B7F6
SHA-512:	285F520B648F5EC70DD79190C3B456F4D6DA2053210985F9E2C84139D8D51908296E4962B336894EE30536F09FAE84B912BC2ABF44A7011620F66CC5D9F71A8C
Malicious:	false
Preview:	#.# Ttk widget set initialization script..#..### Source library scripts..#..namespace eval ::ttk {. variable library. if {![info exists library]} {..set library [file dirname [info script]]. }.}..source [file join $::ttk::library fonts.tcl].source [file join $::ttk::library cursors.tcl].source [file join $::ttk::library utils.tcl]..## ttk::deprecated $old $new --.#.Define $old command as a deprecated alias for $new command.#.$old and $new must be fully namespace-qualified..#.proc ttk::deprecated {old new} {. interp alias {} $old {} ttk::do'deprecate $old $new.}.## do'deprecate --.#.Implementation procedure for deprecated commands --.#.issue a warning (once), then re-alias old to new..#.proc ttk::do'deprecate {old new args} {. deprecated'warning $old $new. interp alias {} $old {} $new. uplevel 1 [linsert $args 0 $new].}..## deprecated'warning --.#.Gripe about use of deprecated commands..#.proc ttk::deprecated'warning {old new} {. puts stderr "$old deprecated -- u

C:\ProgramData\assignee\tk\ttk\utils.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8562
Entropy (8bit):	4.958950985117383
Encrypted:	false
SSDEEP:	192:MpEpXI4jqmW/y3gp9F+QE9PBRc+vWHJOfqW8j3ki3LDRdielRu+MXw+:6yXuwg1oPnc+epOEj31/s/5
MD5:	65193FE52D77B8726B75FBF909EE860A
SHA1:	991DEDD4666462DD9776FDF6C21F24D6CF794C85
SHA-256:	C7CC9A15CFA999CF3763772729CC59F629E7E060AF67B7D783C50530B9B756E1
SHA-512:	E43989F5F368D2E19C9A3521FB82C6C1DD9EEB91DF936A980FFC7674C8B236CB84E113908B8C9899B85430E8FC30315BDEC891071822D701C91C5978096341B7
Malicious:	false
Preview:	#.# Utilities for widget implementations..#..### Focus management..#.# See also: #1516479.#..## ttk::takefocus --.#.This is the default value of the "-takefocus" option.#.for ttk::* widgets that participate in keyboard navigation..#.# NOTES:.#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable].#.if -takefocus is 1, empty, or missing; but not if it's a.#.script prefix, so we have to check that here as well..#.#.proc ttk::takefocus {w} {. expr {[$w instate !disabled] && [winfo viewable $w]}.}..## ttk::GuessTakeFocus --.#.This routine is called as a fallback for widgets.#.with a missing or empty -takefocus option..#.#.It implements the same heuristics as tk::FocusOK..#.proc ttk::GuessTakeFocus {w} {. # Don't traverse to widgets with '-state disabled':. #. if {![catch {$w cget -state} state] && $state eq "disabled"} {..return 0. }.. # Allow traversal to widgets with explicit key or focus bindings:. #. if {[regexp {Key\|Focus} [concat [bind $w] [bind [winfo c

C:\ProgramData\assignee\tk\ttk\vistaTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9349
Entropy (8bit):	4.613570740989389
Encrypted:	false
SSDEEP:	192:kwsdZzIE2NSCyNPNVVSCIA5l/r5l/rWMi/CE38S7r/2JeJnpna+yfdyMq53ICyzl:sZzL24FVeArPKf3z7cQ0383cdd
MD5:	70EFC208940AB312DF76FDB0A4C16DC2
SHA1:	0AC88DA8B62875D8F7178A3666CD6CFB0E5C27E1
SHA-256:	92D0FC7C0839AB4D1ED3765F6467B824735850167C22C082525BBC81EED6CC3B
SHA-512:	5A16EF33E9061402F88C90ACB2A1A4C607C0606BD8AED3BAB2FBD8F75364E2E49F95118408E8C5A64A124B8D667AA53E689C88C8C498EE04E024D2FCA843A82A
Malicious:	false
Preview:	#.# Settings for Microsoft Windows Vista and Server 2008.#..# The Vista theme can only be defined on Windows Vista and above. The theme.# is created in C due to the need to assign a theme-enabled function for .# detecting when themeing is disabled. On systems that cannot support the.# Vista theme, there will be no such theme created and we must not.# evaluate this script...if {"vista" ni [ttk::style theme names]} {. return.}..namespace eval ttk::theme::vista {.. ttk::style theme settings vista {.. .ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -padding 2..ttk::style configure TMenubu

C:\ProgramData\assignee\tk\ttk\winTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2643
Entropy (8bit):	4.8723234445803545
Encrypted:	false
SSDEEP:	48:679ahShG0Ds0IXF6yjAfSAfqFRaBgLtei42kt+5Ql/n+iOaVa9LU:6vM0uTk5tm4v
MD5:	A6EFE03AC019E723627C064AC74DCBF3
SHA1:	9740638A19E6B5360FD69D887A4E01D9818FE43B
SHA-256:	08CE1484FF82AE2842A986B5A44EA81CC375E34687EF0896C8A45938721AA265
SHA-512:	8AB802D41522080CFA974B628CFF2BA3BFC074BC0C99DCF0E0AB647D54D10C9293C7B79F842BB5E8767972CD55724C3646065A2E988D7581863AF4CFD5938EB7
Malicious:	false
Preview:	#.# Settings for 'winnative' theme..#..namespace eval ttk::theme::winnative {. ttk::style theme settings winnative {...ttk::style configure "." \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -troughcolor SystemScrollbar \.. -font TkDefaultFont \.. ;...ttk::style map "." -foreground [list disabled SystemGrayText] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -relief raised -shiftrelief 1..ttk::style configure TCheckbutton -padding "2 4"..ttk::style configure TRadiobutton -padding "2 4"..ttk::style configure TMenubutton \.. -padding "8 4" -arrowsize 3 -relief raised...ttk::style map TButton -relief {{!disabled pressed} sunken}...ttk::style configure TEntry \.. -padding 2 -selectborderwidth 0 -insertwidth 1..ttk::style map TEntry \.. -fieldbackground \.. .[list readonly System

C:\ProgramData\assignee\tk\ttk\xpTheme.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	4.940443388600074
Encrypted:	false
SSDEEP:	48:NaxYun9ahShk/T5QNt+7aVzEmAf8Afb9AfMML:kq1eb
MD5:	176A5DCEB7CF7A201B517B859F923F42
SHA1:	207D85B0ADB45BBCFEBCAEC9E2633FF353BB6449
SHA-256:	351BA00B3A02748FCE2DF2AB79D0C30C445DEF179005B6D7DB739CE3AA8C1658
SHA-512:	07B4466DBD22067D5E038B09D1EA7F578C817E3B73BCBB1F66533A48B817F8400E01B79F5F5FC2FAC46942F5E0DF98745A52E08F5DE078669D771E3794C01F91
Malicious:	false
Preview:	#.# Settings for 'xpnative' theme.#..namespace eval ttk::theme::xpnative {.. ttk::style theme settings xpnative {...ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -padding 2..ttk::style configure TMenubutton -padding {8 4}...ttk::style configure TNotebook -tabmargins {2 2 2 0}..ttk::style map TNotebook.Tab \.. -expand [list selected {2 2 2 2}]...# Treeview:..ttk::style configure Heading -font TkHeadingFont..ttk::style configure Treeview -background SystemWindow..ttk::style map Treeview \.. -background [list selected SystemHighlight] \.. -foreground [list selected SystemHighlight

C:\ProgramData\assignee\tk\unsupported.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10253
Entropy (8bit):	5.021407009733748
Encrypted:	false
SSDEEP:	192:1wMv11IDCB7PFPHGosvS6UMn8O9MGM/OTMjcrrwrt:puMYMj+sZ
MD5:	AF2C1D93B2E694E8D2AC40FA05317C13
SHA1:	6A3C31B070778CCB4097C2C6183EB5E58DE10DAB
SHA-256:	04E692D34020CA245AA844B9529670F8B4822A299FC0B93006FC08D311DEE7CE
SHA-512:	B7DF12DD04BB1971A5D904E99E0E92E7AD67EDFA0A51D1DC8797307E09D88D23298FDA8CCB1CA36ADAB2A1F693AD89651C11934F6B7DA6357ACB97DE22BEFE59
Malicious:	false
Preview:	# unsupported.tcl --.#.# Commands provided by Tk without official support. Use them at your.# own risk. They may change or go away without notice..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# ----------------------------------------------------------------------.# Unsupported compatibility interface for folks accessing Tk's private.# commands and variable against recommended usage..# ----------------------------------------------------------------------..namespace eval ::tk::unsupported {.. # Map from the old global names of Tk private commands to their. # new namespace-encapsulated names... variable PrivateCommands . array set PrivateCommands {..tkButtonAutoInvoke..::tk::ButtonAutoInvoke..tkButtonDown...::tk::ButtonDown..tkButtonEnter...::tk::ButtonEnter..tkButtonInvoke...::tk::ButtonInvoke..tkButtonLeave...::tk::ButtonLeave..tkButtonUp...::tk::ButtonUp..tkCancelRepeat...::tk::Canc

C:\ProgramData\assignee\tk\xmfbox.tcl

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	26045
Entropy (8bit):	4.921671226936127
Encrypted:	false
SSDEEP:	384:obPApXi6V2+Bec3ijn7H6HZ1KDRvRcbQ3sd1GkjDo413lK/RIVOMXrSommjiETwZ:orAZTbFc3sd1GkF3cIVUx01w
MD5:	25A756569D336F859881E99BCB06B63C
SHA1:	77E6F65FDBF4BA839F1EA60BA016122B5744C32E
SHA-256:	92DA54EC916E56A81901D68BD528DBC30F70CA150802B50DAACBEE097BD234C2
SHA-512:	4DC742ADC0B7FA3C9678E930635792D0D8A9B87B059742DC9BFE7A53C07E833110DB599F963408314A02C8A09B2D041F8EB512339D76626B4AF101EA49780BC4
Malicious:	false
Preview:	# xmfbox.tcl --.#.#.Implements the "Motif" style file selection dialog for the.#.Unix platform. This implementation is used only if the.#."::tk_strictMotif" flag is set..#.# Copyright (c) 1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Scriptics Corporation.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}...# ::tk::MotifFDialog --.#.#.Implements a file dialog similar to the standard Motif file.#.selection box..#.# Arguments:.#.type.."open" or "save".#.args..Options parsed by the procedure..#.# Results:.#.When -multiple is set to 0, this returns the absolute pathname.#.of the selected file. (NOTE: This is not the same as a single.#.element list.).# .#.When -multiple is set to > 0, this returns a Tcl list of absolute.# pathnames. The argument for -multiple is ignored, but for consistency.# with Windows it defines the ma

C:\ProgramData\assignee\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	758784
Entropy (8bit):	5.610283288651192
Encrypted:	false
SSDEEP:	12288:b+sJ1h36V8UTApugN1byv9rN30xD3dNZJB4pvdob91TaT:xh3lHfyD30t3dc5mbTaT
MD5:	F66CDE98CA47F122710E4008246D45E9
SHA1:	5CC592C03BE31F5D99D69A6EB83FAE44D2E1E8DE
SHA-256:	5DF0E5E83BE746D46DB28DA04B5936E0F178BE1D2F0B3C3A9CFDA8CC1553480D
SHA-512:	E2898A96243108DDCC3C07DEC7DB2CED1A995029D710F860C6CDDF4833E8BB41372939F96F7A0A23749C44A1C88AB5722764907024D1AF3CC3CDBD74FCCB17B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)..P)..P)..P2beP+..P2bQP%..P2bPP+..P2bgP,..P .hP+..P)..Pi..P2bUP(..P2b`P(..P2bfP(..PRich)..P........PE..L...I.vV...........!.....(...l.......1.......@............................................@..........................t..U...<n..P................................... A..............................(m..@............@...............................text....'.......(.................. ..`.rdata...4...@...6...,..............@..@.data....).......&...b..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\assignee\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	6.5246605584708774
Encrypted:	false
SSDEEP:	1536:vnLOP1dAEZ0FLoNqtH7oQPTc8J/W9wNHa4OnC1ADIwLw5VhV3LMhsNIxha/C2cIX:vnLOQEZ8ogXTc8BW9wNHD19VhV3LMhsH
MD5:	CE11BA5CDC3B2027B9B62384F45AB7C6
SHA1:	1115FF4A00323CDB059477F138C351D3E4DB9A85
SHA-256:	4A0757553C39B5309E9650CC2975875B1378D49075A9FE0DA3E50698D064334A
SHA-512:	4C85E44BEC8B5A98DCDC4E8854B0FD84117EC14D9C0F0A53073EB2F978803503990F90B34CD1D6BD5E1C6EC999B4B7E245221F6CE67A1BDA076C4B1C3BBB3A17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{-.g?L.4?L.4?L.4P:O4<L.4P:{43L.4P:M4;L.4$.M4=L.464B44L.4?L.4.M.4P:z48L.4P:J4>L.4P:L4>L.4Rich?L.4........PE..L...rO.X...........!................/.....................................................@..........................V.......2..........L....................... ...0...............................`0..@...................42..@....................text...<........................... ..`.rdata...v.......x..................@..@.data........`.......J..............@....rsrc...L............\..............@..@.reloc..n............`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\assignee.lnk

Download File

Process:	C:\Users\user\Desktop\p2K.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Sep 28 23:18:15 2024, mtime=Sat Sep 28 23:18:15 2024, atime=Sat Sep 28 23:18:15 2024, length=10840576, window=hide
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.457330603653062
Encrypted:	false
SSDEEP:	24:8msWb1b8/fYO6pmrJEmR8A6TmHLm3Tm5VTzm:8mBJQ/f1rJXR766Hy36v
MD5:	3184662F66C8420126180C56EDDF1768
SHA1:	4C924026785DD48CFD426305406AB2290E2E89D1
SHA-256:	482E5259AFFFA7F168FF66D99A04722B412CB3CEBC15C03715F7AE3564BF2866
SHA-512:	2A56D3DC7650BDE7CF8FA85D773F898065FE67CC6D6FA479350F220F49B3384A9A5D26BFFE66D1B16C146F526F0BE78997AAAD3D19894E508334D97B94599736
Malicious:	false
Preview:	L..................F.... ...Nm.......................j......................O....P.O. .:i.....+00.../C:\...................`.1.....=YD.. PROGRA~3..H......O.I=YD.....g.......................#.P.r.o.g.r.a.m.D.a.t.a.....Z.1.....=YH...assignee..B......=YH.=YH..............................a.s.s.i.g.n.e.e.....f.2..j..=YH. .assignee.exe..J......=YH.=YH.............................M.a.s.s.i.g.n.e.e...e.x.e.......S...............-.......R............H.......C:\ProgramData\assignee\assignee.exe..<.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.a.s.s.i.g.n.e.e.\.a.s.s.i.g.n.e.e...e.x.e...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.a.s.s.i.g.n.e.e.`.......X.......358075...........hT..CrF.f4... ....Jc...-...-$..hT..CrF.f4... ....Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.988021689276711
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	p2K.exe
File size:	6'985'546 bytes
MD5:	b8974a6a9406e8c8d4345f6dcba034b2
SHA1:	4f4d2e7e11bce3c45abb0fb182513627357be9a2
SHA256:	6a6b6d460945b063180ee5a4580d29ee01f3bd1a2c5c82684512093e3655ba00
SHA512:	4b48911531ce081dba0014542995d9e9705515b622477c6e503b7d13cae7e16e8c8eb3d4c356ba507fcede1c3fe52fd6e2fce58c2e1387b6db1d31484f6ef940
SSDEEP:	98304:ppUlKdJbH7yP+XlxY6F4Svk4/AW8w2PI5+/29b6/TQXLBf2lXafDLmch/nIQvMJp:pplW2E6F/KPS+/20jXauc3vMJOrDCt
TLSH:	0A663352F6E944B6D85207314EF987816A3C3E60FFA98C8F63887D1C8A109D1E635B77
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x4265d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6640971F [Sun May 12 10:17:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	99ee65c2db82c04251a5c24f214c8892

Entrypoint Preview

Instruction
call 00007F383910C9BBh
jmp 00007F383910C33Dh
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F383910B9EFh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F383910B9D9h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F38390FEF19h
push 0044634Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F383910D1E7h
int3
jmp 00007F3839112F1Eh
int3
int3
push 004293C0h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00449778h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push ebp
mov ebp, esp

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x47d70	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47da4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0xe360	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x67000	0x2afc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x44580	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x44600	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3ec58	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c000	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4722c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a32c	0x3a400	e320764e1b3c816ba80aeb820cb8a274	False	0.581381605418455	data	6.685359764265178	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3c000	0xcbf8	0xcc00	47c3be3304bfdfb2a778f355849d1c3f	False	0.4439529718137255	data	5.167069652624378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x49000	0xd7e0	0x1200	6335f9314c2900dccb530e151f1b1ee8	False	0.3956163194444444	data	4.0290550032041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x57000	0x1a8	0x200	232a8fe82993b55cefe09cffc39a79b0	False	0.462890625	data	3.5080985761326375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x58000	0xe360	0xe400	4608b3917311b11e58d5198fc7272acf	False	0.6301226699561403	data	6.596441520276781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x67000	0x2afc	0x2c00	98fd4bc572f87a21f69dc57f720a6dbc	False	0.75	data	6.617141671767599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x58680	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x591c8	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x5a778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x5ace0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x5b588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x5c430	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x5c898	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x5d940	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x5fee8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x645b8	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x64388	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x644c8	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x64258	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x63f20	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x63cc8	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x64f98	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x65180	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x65350	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x65508	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x65650	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x65ac0	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x65c28	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x65d80	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x65e90	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x65f50	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x66110	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x63c60	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x64840	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA, FindNextFileA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	20:18:14
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\p2K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\p2K.exe" -pF5Vt8d1X0LWj
Imagebase:	0xfe0000
File size:	6'985'546 bytes
MD5 hash:	B8974A6A9406E8C8D4345F6DCBA034B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:18:22
Start date:	28/09/2024
Path:	C:\ProgramData\assignee\assignee.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\assignee\assignee.exe" "2YgTMci4EewqpK"
Imagebase:	0x8a0000
File size:	10'840'576 bytes
MD5 hash:	DA4E8EBC459D4E4FA60C17B7E25ECBB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	20:18:32
Start date:	28/09/2024
Path:	C:\ProgramData\assignee\assignee.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\assignee\assignee.exe"
Imagebase:	0x8a0000
File size:	10'840'576 bytes
MD5 hash:	DA4E8EBC459D4E4FA60C17B7E25ECBB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 0100454A Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 252
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF6D7B: GetModuleHandleW.KERNEL32(kernel32,3ACC59D7), ref: 00FF6DC7
Part of subcall function 00FF6D7B: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00FF6DD9
Part of subcall function 00FF6D7B: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00FF6E03

Part of subcall function 00FF1309: __EH_prolog3.LIBCMT ref: 00FF1310
Part of subcall function 00FF1309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00FF17FB,?,?,\\?\,3ACC59D7,?,?,?,00000000,0101A279,000000FF), ref: 00FF1319

Part of subcall function 00FFF4D4: OleInitialize.OLE32(00000000), ref: 00FFF4ED
Part of subcall function 00FFF4D4: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00FFF524
Part of subcall function 00FFF4D4: SHGetMalloc.SHELL32(0103532C), ref: 00FFF52E

GetCommandLineW.KERNEL32 ref: 01004608
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp,?,00000000), ref: 0100464F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009,?,00000000), ref: 01004661
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 0100466F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,00000000), ref: 0100467D

Part of subcall function 00FFFC38: __EH_prolog3.LIBCMT ref: 00FFFC3F

Part of subcall function 01003EFC: __EH_prolog3_GS.LIBCMT ref: 01003F03
Part of subcall function 01003EFC: SetEnvironmentVariableW.KERNEL32(sfxcmd,?,?,?,?,?,?,00000028), ref: 01003F1B
Part of subcall function 01003EFC: SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 01003F86

Part of subcall function 00FF51BF: _wcslen.LIBCMT ref: 00FF51E3

UnmapViewOfFile.KERNEL32(00000000,01035430,00000400,01035430,01035430,00000400,00000000,00000001,?,00000000), ref: 010046CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 010046D3
SetEnvironmentVariableW.KERNEL32(sfxname,01029698,00000000), ref: 0100472F
GetLocalTime.KERNEL32(?), ref: 0100473A
_swprintf.LIBCMT ref: 01004779
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0100478E
GetModuleHandleW.KERNEL32(00000000), ref: 01004795
LoadIconW.USER32(00000000,00000064), ref: 010047AC
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00020900,00000000), ref: 01004803
Sleep.KERNEL32(00000000), ref: 01004834
DeleteObject.GDI32 ref: 01004858
DeleteObject.GDI32(14050DFC), ref: 01004868

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

Part of subcall function 010019EE: __EH_prolog3_GS.LIBCMT ref: 010019F5

CloseHandle.KERNEL32 ref: 010048AA

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0100476A
sfxname, xrefs: 0100472A
winrarsfxmappingfile.tmp, xrefs: 01004643
STARTDLG, xrefs: 010047F8
sfxstime, xrefs: 01004789

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$AddressCloseDeleteH_prolog3H_prolog3_ModuleObjectProcUnmap_wcslen$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3142445277-3710569615
Opcode ID: 08123d7dfb367b026ab6b9491f1f40a4b433e0976c3a28c6017fead16c38f00c
Instruction ID: 95557b2b491c0f604e718c8edc599ed47099e57c41daefe4bd222691eb8a42ff
Opcode Fuzzy Hash: 08123d7dfb367b026ab6b9491f1f40a4b433e0976c3a28c6017fead16c38f00c
Instruction Fuzzy Hash: AF91CCB0544344ABE331AF65DC85BABBBECAF89700F40081DFAC9D2195EB7D9504DB21

Function 00FFEBD3 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,01000845,00000066), ref: 00FFEBE6
SizeofResource.KERNEL32(00000000,?,?,?,01000845,00000066), ref: 00FFEBFD
LoadResource.KERNEL32(00000000,?,?,?,01000845,00000066), ref: 00FFEC14
LockResource.KERNEL32(00000000,?,?,?,01000845,00000066), ref: 00FFEC23
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,01000845,00000066), ref: 00FFEC3E
GlobalLock.KERNEL32(00000000), ref: 00FFEC4F
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00FFEC73
GlobalUnlock.KERNEL32(00000000), ref: 00FFECD7

Part of subcall function 00FFEB06: GdipAlloc.GDIPLUS(00000010), ref: 00FFEB0C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00FFECB8
GlobalFree.KERNEL32(00000000), ref: 00FFECDE

Strings

PNG, xrefs: 00FFEBD7

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 618113bccacb8bce4c67181f540a0f96aca940a5e5a9fe8af9d9f0079ef92854
Instruction ID: dc68ede6497120b3bbbdcf510ac132865e89ef83bba4b6f4ffc67b4857c2289c
Opcode Fuzzy Hash: 618113bccacb8bce4c67181f540a0f96aca940a5e5a9fe8af9d9f0079ef92854
Instruction Fuzzy Hash: 0A318F71A80206AFE7319F61DD48D2B7FACFF45764B100529FA85D2264EB3AD801DB61

Function 00FF355D Relevance: 14.8, APIs: 2, Strings: 6, Instructions: 753COMMON

Download Yara Rule

APIs

Part of subcall function 00FF8781: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,3ACC59D7,00000007,?,?,?,00FF8751,?,?,?,?,0000000C,00FE4426), ref: 00FF879D

_wcslen.LIBCMT ref: 00FF395A
__fprintf_l.LIBCMT ref: 00FF3AA7

Strings

*messages***, xrefs: 00FF373A
@%s:, xrefs: 00FF3A91, 00FF3A9D
RTL, xrefs: 00FF3A69
$%s:, xrefs: 00FF3A8A
*messages***, xrefs: 00FF3773
,, xrefs: 00FF3AE2

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_wcslen
String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL
API String ID: 1796436225-285229759
Opcode ID: 14932ab5df563761c2d8acaf493ab72b2d429f760cc7b89d81b5e6573a918c5b
Instruction ID: 05f9c855a489564cc59b0c61b201ba074afcd445f7154816919e7c5ba0f9bfbd
Opcode Fuzzy Hash: 14932ab5df563761c2d8acaf493ab72b2d429f760cc7b89d81b5e6573a918c5b
Instruction Fuzzy Hash: 5152A072D0025DABDF24DFA8CC85AFDB7B4FF04710F10052AE645AB2A0EB749A44DB60

Function 00FEF826 Relevance: 9.1, APIs: 6, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEF830
FindFirstFileW.KERNEL32(?,?,00000274,00FEF733,000000FF,00000049,00000049,?,?,00FEA684,?,?,00000000,?,?,?), ref: 00FEF859
FindFirstFileW.KERNEL32(?,?,?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049), ref: 00FEF8A4
GetLastError.KERNEL32(?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049,?,00000000), ref: 00FEF902
FindNextFileW.KERNEL32(?,?,00000274,00FEF733,000000FF,00000049,00000049,?,?,00FEA684,?,?,00000000,?,?,?), ref: 00FEF92D
GetLastError.KERNEL32(?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049,?,00000000), ref: 00FEF93A

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$H_prolog3_Next
String ID:
API String ID: 3831798110-0
Opcode ID: 8c237635662805854e7a97d99df2f49e93903d691f4e7f7aa791f54d86896031
Instruction ID: d5988f0107f2089e0b1963eae8aa430fa339ff1f0bd8697d236b4c8ca3b0fb2e
Opcode Fuzzy Hash: 8c237635662805854e7a97d99df2f49e93903d691f4e7f7aa791f54d86896031
Instruction Fuzzy Hash: 57513D71D04659ABDF24DF65CC88AEDB7B4BF09320F1002AAE559E3290DB34AB84DF50

Function 00FEBF3D Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1497COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FEC342

Part of subcall function 00FF2095: __EH_prolog3_GS.LIBCMT ref: 00FF209C

Part of subcall function 00FE57C0: __EH_prolog3.LIBCMT ref: 00FE57C7

Strings

__tmp_reference_source_, xrefs: 00FEC33D, 00FEC349

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3H_prolog3__wcslen
String ID: __tmp_reference_source_
API String ID: 1523997010-685763994
Opcode ID: 63993f59134bccd90d43aa3b3bbd551291b723f2ad3c83902481cdf6d72c668f
Instruction ID: b4a6ac2d33282c71320003db9f3e14557bd138c161c50b8507b05849f3fdb034
Opcode Fuzzy Hash: 63993f59134bccd90d43aa3b3bbd551291b723f2ad3c83902481cdf6d72c668f
Instruction Fuzzy Hash: CAD2E4719042C99FDF29DF75C890BEEBBB5BF05304F04012EE59A97241D734A94AEB90

Function 0100ECAA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,0100EC80,00000000,01026F40,0000000C,0100EDD7,00000000,00000002,00000000), ref: 0100ECCB
TerminateProcess.KERNEL32(00000000,?,0100EC80,00000000,01026F40,0000000C,0100EDD7,00000000,00000002,00000000), ref: 0100ECD2
ExitProcess.KERNEL32 ref: 0100ECE4

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cac61f6794db768b52b412870ae271ba03f77bc6f0c673c0b9f1cc4458e35296
Instruction ID: d7231ce284a8b81ab3c202d47523a3a13914a46bde6fc911ab5fcace486cf6ab
Opcode Fuzzy Hash: cac61f6794db768b52b412870ae271ba03f77bc6f0c673c0b9f1cc4458e35296
Instruction Fuzzy Hash: 38E0BF3118060CAFEF267F54DA08A983B69EF51241F440864F9856A165CB3FD942DB40

Function 00FFE91A Relevance: 1.7, APIs: 1, Instructions: 154comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0101E8EC,00000000,00000001,0101E7FC,?), ref: 00FFE931

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ee99699e0927bc3893f10f83a15b36494b4120140da4af1a2cce3f101bb5299b
Instruction ID: 21b22f20db3d11486608513bb5359786b31d7f80eb11efe82738e0f6f908bbb6
Opcode Fuzzy Hash: ee99699e0927bc3893f10f83a15b36494b4120140da4af1a2cce3f101bb5299b
Instruction Fuzzy Hash: CB516875A00215EFD754CF54C88492ABBBAFF88700B10455EF6869B260CB79EC82DFA1

Function 00FFB76F Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 2a6da861166c6c4142bba4037d2185bc84740b2c7c1ec3fa1de0c1d259d8fc4e
Instruction ID: 12865d9446de0adb302921a8ed2845dbcab0cbed2dec9fc5840269c03433f428
Opcode Fuzzy Hash: 2a6da861166c6c4142bba4037d2185bc84740b2c7c1ec3fa1de0c1d259d8fc4e
Instruction Fuzzy Hash: 0DE1F671A083498FDB24DF28C884B6BBBE1BFC8314F04456DEA889B361D774E945DB52

Function 01000900 Relevance: 86.7, APIs: 42, Strings: 7, Instructions: 935windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0100090A

Part of subcall function 00FE1E44: GetDlgItem.USER32(00000000,00003021), ref: 00FE1E88
Part of subcall function 00FE1E44: SetWindowTextW.USER32(00000000,0101C6C8), ref: 00FE1E9E

EndDialog.USER32(?,00000000), ref: 01000A18
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 01000A57
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 01000A71
IsDialogMessageW.USER32(?,?), ref: 01000A84
TranslateMessage.USER32(?), ref: 01000A92
DispatchMessageW.USER32(?), ref: 01000A9C
EndDialog.USER32(?,00000001), ref: 01000ADE
GetDlgItem.USER32(?,00000068), ref: 01000B04
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 01000B1F
SendMessageW.USER32(00000000,000000C2,00000000,0101C6C8), ref: 01000B32
SetFocus.USER32(00000000), ref: 01000B39
GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 01000C20
GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 01000C4C
GetTickCount.KERNEL32 ref: 01000C79
GetLastError.KERNEL32(?,00000011), ref: 01000CD5
GetCommandLineW.KERNEL32 ref: 01000DF9
_wcslen.LIBCMT ref: 01000E06
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,?,winrarsfxmappingfile.tmp,?,01035430,00000400,00000001,00000001), ref: 01000E85
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 01000EA3
ShellExecuteExW.SHELL32(0000003C), ref: 01000EDC
Sleep.KERNEL32(00000064), ref: 01000F25
UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,01035430,00000400), ref: 01000F61
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,01035430,00000400), ref: 01000F6D
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 01001072

Part of subcall function 00FE1E1F: GetDlgItem.USER32(?,?), ref: 00FE1E34
Part of subcall function 00FE1E1F: ShowWindow.USER32(00000000), ref: 00FE1E3B

SetDlgItemTextW.USER32(?,00000065,0101C6C8), ref: 0100108A
GetDlgItem.USER32(?,00000065), ref: 01001093
GetWindowLongW.USER32(00000000,000000F0), ref: 010010A2
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_000206D0,00000000,?), ref: 01001422
EndDialog.USER32(?,00000001), ref: 01001436
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 010010B1

Part of subcall function 00FFE265: __EH_prolog3_GS.LIBCMT ref: 00FFE26C
Part of subcall function 00FFE265: ShowWindow.USER32(?,00000000,00000038), ref: 00FFE294
Part of subcall function 00FFE265: GetWindowRect.USER32(?,?), ref: 00FFE2D8
Part of subcall function 00FFE265: ShowWindow.USER32(?,00000005,?,00000000), ref: 00FFE373

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0100114F
SendMessageW.USER32(?,00000080,00000001,00010405), ref: 01001284
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,14050DFC), ref: 0100129D
GetDlgItem.USER32(?,00000068), ref: 010012A6
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 010012BE
GetDlgItem.USER32(?,00000066), ref: 010012E6
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0100135D
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 01001371
EnableWindow.USER32(?,00000000), ref: 010015A7
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 010015E8
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0100160D

Part of subcall function 01001D4F: __EH_prolog3_GS.LIBCMT ref: 01001D59

Strings

@, xrefs: 01000D98
winrarsfxmappingfile.tmp, xrefs: 01000E71
__tmp_rar_sfx_access_check_, xrefs: 01000C91
STARTDLG, xrefs: 0100091C
LICENSEDLG, xrefs: 01001417
-el -s2 "-d%s" "-sp%s", xrefs: 01000D75
<, xrefs: 01000D8E

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Item$Message$TextWindow$Send$Dialog$ErrorFileLastShow$H_prolog3_LongView$CloseCommandCountCreateDispatchEnableExecuteFocusH_prolog3_catch_HandleLineMappingParamRectShellSleepTickTranslateUnmap_wcslen
String ID: -el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_$winrarsfxmappingfile.tmp
API String ID: 77847825-3000381960
Opcode ID: 5e06257a4ce31a32d23619d97fcb40b44759d0490ae58596521ee1b7d5fda3bc
Instruction ID: 50beb75a084a364bdcd95eaa4170f0ff22ea71c1807736af78aeef81171f376d
Opcode Fuzzy Hash: 5e06257a4ce31a32d23619d97fcb40b44759d0490ae58596521ee1b7d5fda3bc
Instruction Fuzzy Hash: 3872C270940288EEFB32EB64CC49FEE7BB9AB05704F044099F185B71D6DBB95A44DB21

Function 00FF6D7B Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 394
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,3ACC59D7), ref: 00FF6DC7
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00FF6DD9
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00FF6E03
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF70CA
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FF70DF
ReadFile.KERNEL32(00000000,?,00007FFE,?,00000000), ref: 00FF70FF
CloseHandle.KERNEL32(00000000), ref: 00FF7187
CompareStringW.KERNEL32(00000400,00001001,?,000000FF,DXGIDebug.dll,000000FF,?,?,?), ref: 00FF71F8
AllocConsole.KERNEL32 ref: 00FF735E
GetCurrentProcessId.KERNEL32 ref: 00FF7368
AttachConsole.KERNEL32(00000000), ref: 00FF736F
GetStdHandle.KERNEL32(000000F4,00000000,00000000,?,00000000), ref: 00FF738F
WriteConsoleW.KERNEL32(00000000), ref: 00FF7396
Sleep.KERNEL32(00002710), ref: 00FF73A1
FreeConsole.KERNEL32 ref: 00FF73A7
ExitProcess.KERNEL32 ref: 00FF73B7

Strings

uxtheme.dll, xrefs: 00FF72BD
SetDllDirectoryW, xrefs: 00FF6DD3
SetDefaultDllDirectories, xrefs: 00FF6DFD
DXGIDebug.dll, xrefs: 00FF6E37, 00FF71E0
kernel32, xrefs: 00FF6DBE
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00FF734E
dwmapi.dll, xrefs: 00FF6E6C, 00FF72B3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentExitFreeModulePointerReadSleepStringWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 2644799563-3298887752
Opcode ID: 7c11084512002c2dd6fef565b71a1e369e2b64796c01db23eecd51604ad213a0
Instruction ID: 9b728a7db689e7d520c1432605fcfdcf767ea442bb96a9495ec6285a39d6cebc
Opcode Fuzzy Hash: 7c11084512002c2dd6fef565b71a1e369e2b64796c01db23eecd51604ad213a0
Instruction Fuzzy Hash: 6DF1A1B144038C9BDB39EFA4CC49BEE7BA9BF05314F104119FA899B295DB3C9609DB50

Function 01003572 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01000678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 01000689
Part of subcall function 01000678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0100069A
Part of subcall function 01000678: IsDialogMessageW.USER32(0001040E,?), ref: 010006AE
Part of subcall function 01000678: TranslateMessage.USER32(?), ref: 010006BC
Part of subcall function 01000678: DispatchMessageW.USER32(?), ref: 010006C6

GetDlgItem.USER32(00000068,00000000), ref: 01003595
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,00FFFD20,00000001,?,?), ref: 010035BA
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 010035C9
SendMessageW.USER32(00000000,000000C2,00000000,0101C6C8), ref: 010035D7
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 010035F1
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0100360B
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0100364F
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 01003662
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 01003675
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0100369C
SendMessageW.USER32(00000000,000000C2,00000000,0101C860), ref: 010036AB

Strings

\, xrefs: 010035FB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 2f64ace69099faa4aedb572f99cf850da21ba63c458483b7b3ab128a112a3f7e
Instruction ID: db5864295857697ea5de4c191ea76b41221a3f9c12be76685d3afdf3d64622d5
Opcode Fuzzy Hash: 2f64ace69099faa4aedb572f99cf850da21ba63c458483b7b3ab128a112a3f7e
Instruction Fuzzy Hash: 7B31D2B2245700BFE3219F28DC49FAB7BEDEB45711F000518FAD19A1C4D76A9904CBA6

Function 010038A0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 010038A7
ShellExecuteExW.SHELL32(?), ref: 01003AA4
ShowWindow.USER32(?,00000000), ref: 01003ADD
GetExitCodeProcess.KERNEL32(?,?), ref: 01003B0F
CloseHandle.KERNEL32(?), ref: 01003B33
ShowWindow.USER32(?,00000001), ref: 01003B76

Strings

.inf, xrefs: 01003A13
.exe, xrefs: 01003B3D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitH_prolog3_HandleProcessShell
String ID: .exe$.inf
API String ID: 1358420184-3750412487
Opcode ID: f2a04e4e10cb71dfb19d934659adbfc6bfa35be12ebcd68268f1626bffe03626
Instruction ID: afcff08bc4b99049bac5aaf54a555ea2fc31125d076c4962a442c9ec4812bfec
Opcode Fuzzy Hash: f2a04e4e10cb71dfb19d934659adbfc6bfa35be12ebcd68268f1626bffe03626
Instruction Fuzzy Hash: 4DB1CF31A00248DFEB27DF68C9847ED7BF5FF45310F188159EA84AB291DB78AA45CB50

Function 01002F8D Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 010031A4

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

SHChangeNotify.SHELL32(00001000,00000005,?,00000000), ref: 010032D8

Strings

lnk, xrefs: 01003165
.lnk, xrefs: 0100319E, 010031AB
0, xrefs: 01003261

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _wcslen$ChangeNotify
String ID: .lnk$0$lnk
API String ID: 3865555058-906397761
Opcode ID: 2431ea4676031f46541185b955a1d9f5ecb6a9f64cab90409cc8d84c832f6d93
Instruction ID: 313550104f9c78cdb172aa5743b236650abd9620160de2163ab51bd3f4b375cb
Opcode Fuzzy Hash: 2431ea4676031f46541185b955a1d9f5ecb6a9f64cab90409cc8d84c832f6d93
Instruction Fuzzy Hash: 59E119719012589FEB66DBA5CC85BEDB7B8BF08300F0405EAE549A7291DB389B84DF50

Function 01002493 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000066), ref: 010026A9
SendMessageW.USER32(00000000,00000143,00000000,01035380), ref: 010026D6
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 01002702

Strings

ProgramFilesDir, xrefs: 010025E0
Software\Microsoft\Windows\CurrentVersion, xrefs: 010025F4

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: MessageSend$Item
String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3888421826-2634093826
Opcode ID: f18278e6d564f462caedbb0e364d9d4ca8cfac9c1681e881ece44903faa31dae
Instruction ID: 0246d32908071edcbac1921d9758aad72188a7f7169533d99ac8d06614c04ecd
Opcode Fuzzy Hash: f18278e6d564f462caedbb0e364d9d4ca8cfac9c1681e881ece44903faa31dae
Instruction Fuzzy Hash: 00818071800258DEEF26EBE4CC95BEDB7B8BF18710F040099E586B7181EB755B89DB60

Function 00FF5094 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF6C5E: __EH_prolog3_GS.LIBCMT ref: 00FF6C65
Part of subcall function 00FF6C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00FF6C9A

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00FF50B3
GetProcAddress.KERNEL32(010351F8,CryptUnprotectMemory), ref: 00FF50C3

Strings

CryptProtectMemory, xrefs: 00FF50AD
Crypt32.dll, xrefs: 00FF509D
CryptUnprotectMemory, xrefs: 00FF50B9

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AddressProc$DirectoryH_prolog3_System
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 270589589-1753850145
Opcode ID: 97f0654bf8d82a5765ede48cea39ac60c620c9ab16b14971246a80446f4a1b66
Instruction ID: 62cddbe2b514a35926625d283d9b4008a45568162967ac1ff46e55dec780f602
Opcode Fuzzy Hash: 97f0654bf8d82a5765ede48cea39ac60c620c9ab16b14971246a80446f4a1b66
Instruction Fuzzy Hash: 7CE0DF708807029EE7316B35DA087027ED05F05B14F00880DB1D9C3105DABDE4408B50

Function 00FEE180 Relevance: 7.7, APIs: 5, Instructions: 183
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,00000001,00000000,00000000,00000003,08000000,00000000,3ACC59D7,?,?,00000000,?,?,00000000,01019E6B,000000FF), ref: 00FEE248
GetLastError.KERNEL32(?,?,00000000,01019E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00FEE25A
CreateFileW.KERNEL32(?,00000001,00000000,00000000,00000003,08000000,00000000,?,?,?,?,00000000,01019E6B,000000FF,?,00000011), ref: 00FEE2A6
GetLastError.KERNEL32(?,?,00000000,01019E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00FEE2AF
SetFileTime.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,01019E6B,000000FF,?,00000011,?,?,00000000,?,?), ref: 00FEE346

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 10e4e79b191a3a50d419bd392ab5914b0cf715c3e2a5a90bb9b3b856b4394178
Instruction ID: 27a6108ee0b90fa38ede2ea06594f4ff2c9f346e6aa13f3fb712fdde672f456f
Opcode Fuzzy Hash: 10e4e79b191a3a50d419bd392ab5914b0cf715c3e2a5a90bb9b3b856b4394178
Instruction Fuzzy Hash: 7F619E71D042899FDB24CFA5E985BEE7BB4FF08324F20062AF91597280D778A944DB94

Function 00FEF3BE Relevance: 7.7, APIs: 5, Instructions: 161
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEF3C5
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,00000050,00FEB749,?,?,?,?,?,?), ref: 00FEF450
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?), ref: 00FEF4A7
SetFileTime.KERNEL32(?,?,?,?), ref: 00FEF569
CloseHandle.KERNEL32(?), ref: 00FEF570

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: File$Create$CloseH_prolog3_HandleTime
String ID:
API String ID: 4002707884-0
Opcode ID: 0ffa92d2ce42ca812a8d23b71df7662a759ade9819b08f73d9211e72300a707d
Instruction ID: 07f67eb5c229279e001d0cfc1dc116c9d5c78ec32866b313c494c6a062952719
Opcode Fuzzy Hash: 0ffa92d2ce42ca812a8d23b71df7662a759ade9819b08f73d9211e72300a707d
Instruction Fuzzy Hash: E7517E70E00289AAEF25DFE5D845BEEBBB5AF49320F140129F551F72C0D7389A49DB24

Function 01000678 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 01000689
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0100069A
IsDialogMessageW.USER32(0001040E,?), ref: 010006AE
TranslateMessage.USER32(?), ref: 010006BC
DispatchMessageW.USER32(?), ref: 010006C6

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 32b2b3adef6f66dc37f0b0a9ab40bc24792a6d80ead150d67819674a7ae25eab
Instruction ID: 798e2a4c16fb44748a7cfcb53b4a9aea7dc4223cee1223d60a1939938f108ae9
Opcode Fuzzy Hash: 32b2b3adef6f66dc37f0b0a9ab40bc24792a6d80ead150d67819674a7ae25eab
Instruction Fuzzy Hash: 2BF0D6B590121AEBDB309BE5DC4CEDB7FACEE451917004455F54AD2044E729D105C7F0

Function 01002813 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 010028B3

Strings

MIN, xrefs: 010029A4
MAX, xrefs: 01002970
HIDE, xrefs: 0100293D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _wcslen
String ID: HIDE$MAX$MIN
API String ID: 176396367-2426493550
Opcode ID: bbafc8965b80847142d51250fedc14ca87e7dd9b2a7dc96c4cea95c214b24721
Instruction ID: f76235f6d2460f594f217f01e1c53cf2a294628f21314e434b88dad556aa2c7f
Opcode Fuzzy Hash: bbafc8965b80847142d51250fedc14ca87e7dd9b2a7dc96c4cea95c214b24721
Instruction Fuzzy Hash: 64A1A171C01298CFDB26DFA5CC85ADDBBB8BF4A314F14019AD444B7282EB345B85DB51

Function 00FFF2CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00FFF2EF
SHAutoComplete.SHLWAPI(?,00000010), ref: 00FFF326

Part of subcall function 00FF8DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00FF0E3F,?,?,?,00000046,00FF1ECE,00000046,?,exe,00000046), ref: 00FF8DBA

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00FFF316

Strings

EDIT, xrefs: 00FFF2FA, 00FFF305, 00FFF312

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 361d44c3e9a95cae46b5ead3348a4a689edad581ad320139e0ff0b06c1efc1aa
Instruction ID: db80b009adff2ba780adb49e94756bcd4d3b4b9c2cc81180b1b7e71628563ba4
Opcode Fuzzy Hash: 361d44c3e9a95cae46b5ead3348a4a689edad581ad320139e0ff0b06c1efc1aa
Instruction Fuzzy Hash: E6F0C875F01219EBDB309A64DC05FEFB7AC9F45B10F000065FA40E71C4D6B5AA099765

Function 00FFF4D4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF6C5E: __EH_prolog3_GS.LIBCMT ref: 00FF6C65
Part of subcall function 00FF6C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00FF6C9A

OleInitialize.OLE32(00000000), ref: 00FFF4ED
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00FFF524
SHGetMalloc.SHELL32(0103532C), ref: 00FFF52E

Strings

riched20.dll, xrefs: 00FFF4DC

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: DirectoryGdiplusH_prolog3_InitializeMallocStartupSystem
String ID: riched20.dll
API String ID: 2446841611-3360196438
Opcode ID: b14dbed7a1be3a4529ae2e78c269c13cfd5eb841af1644d0f493f8cea3d031ca
Instruction ID: 0ee41498ea2085052e05c165b536c977d3b387c7f14d9090cb162d7435d4c398
Opcode Fuzzy Hash: b14dbed7a1be3a4529ae2e78c269c13cfd5eb841af1644d0f493f8cea3d031ca
Instruction Fuzzy Hash: 8FF0F9B5D00209ABCB20AF9ADC499EEFBFCEF94701F00405AE595E2244DBB956058FA1

Function 00FEE948 Relevance: 6.1, APIs: 4, Instructions: 117fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEE94F
GetStdHandle.KERNEL32(000000F5,0000002C,00FF2D28,?,?,?,?,00000000,00FFABB6,?,?,?,?,?,00FFA80E,?), ref: 00FEE978
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FEE9BE

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FileH_prolog3_HandleWrite
String ID:
API String ID: 2898186245-0
Opcode ID: 54afad6e7d9ca7d8f36503273cb4907e8fa3d8cba7bc4565b7153a76c6357538
Instruction ID: b5e4eafaeeee7816892f6318d1a9f6c3334a192160d37b7abbacf06075c732eb
Opcode Fuzzy Hash: 54afad6e7d9ca7d8f36503273cb4907e8fa3d8cba7bc4565b7153a76c6357538
Instruction Fuzzy Hash: 0041DF35A01295AFEF15CF65E884BED7BB6FF84B10F140128F841AB281CB399D44DBA1

Function 00FEEFEF Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEEFF6
CreateDirectoryW.KERNEL32(?,00000000,?,00000024,00FEEBA7,?,00000001,00000000,?,?,00000024,00FEA4DE,?,00000001,?,?), ref: 00FEF01F
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,00000024,00FEEBA7,?,00000001,00000000,?,?,00000024,00FEA4DE,?), ref: 00FEF075
GetLastError.KERNEL32(?,?,00000024,00FEEBA7,?,00000001,00000000,?,?,00000024,00FEA4DE,?,00000001,?,?,00000000), ref: 00FEF0E3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CreateDirectory$ErrorH_prolog3_Last
String ID:
API String ID: 3709856315-0
Opcode ID: 5606ed9350de931244d338d8bafd2c5ba7232df3da3ae446386b76f3781e3132
Instruction ID: dc0de077ff1737f1a986908163f7065bc228c96023d78e1e107627d6928915c9
Opcode Fuzzy Hash: 5606ed9350de931244d338d8bafd2c5ba7232df3da3ae446386b76f3781e3132
Instruction Fuzzy Hash: 7931D571D00289DFDF11DFE6D988AEEBBB8EF48310F14442AE641E3251C7388948DB61

Function 00FEE019 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,00000000,00FEE5D2,?,?,00000000,?,00000000), ref: 00FEE029
ReadFile.KERNEL32(?,?,00000000,00100000,00000000,?,?,?,00000000,00FEE5D2,?,?,00000000,?,00000000), ref: 00FEE041
GetLastError.KERNEL32(?,?,?,00000000,00FEE5D2,?,?,00000000,?,00000000), ref: 00FEE073
GetLastError.KERNEL32(?,?,?,00000000,00FEE5D2,?,?,00000000,?,00000000), ref: 00FEE092

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: b248f4004a4192b8e7e02c619f26389f284b671203b206b033d81c4258ef3534
Instruction ID: fba4eef023126266a40f4f37d65c262920328fca06650579a015d53899656529
Opcode Fuzzy Hash: b248f4004a4192b8e7e02c619f26389f284b671203b206b033d81c4258ef3534
Instruction Fuzzy Hash: ED118632A00648EBDB319E52E90476E37A9FB41371F104629F66685240D7F9DE44FB51

Function 00FF5109 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FF5094: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00FF50B3
Part of subcall function 00FF5094: GetProcAddress.KERNEL32(010351F8,CryptUnprotectMemory), ref: 00FF50C3

GetCurrentProcessId.KERNEL32(?,00000200,?,00FF5104), ref: 00FF5197

Strings

CryptProtectMemory failed, xrefs: 00FF514E
CryptUnprotectMemory failed, xrefs: 00FF518F

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 6a0ed098c7510fa8aeef37bba8acaa3c1f93719dbc97c36c5dc1aa7a117fd59d
Instruction ID: 07adc5ba578e65a665dfa53e103dcc6c3c02c33e59824bf32dff6f8860bbca62
Opcode Fuzzy Hash: 6a0ed098c7510fa8aeef37bba8acaa3c1f93719dbc97c36c5dc1aa7a117fd59d
Instruction Fuzzy Hash: 3D112931A01A286BEB215F21DC0067E3B59BF41F70B004109FF455F265D779AD01D7D4

Function 00FF7628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,Function_00017760,?,00000000,?), ref: 00FF764C
SetThreadPriority.KERNEL32(?,00000000,?,?,?,?,00000004,00FE736D,00FE5AB0,?), ref: 00FF7693

Part of subcall function 00FE92EB: __EH_prolog3_GS.LIBCMT ref: 00FE92F2

Part of subcall function 00FE9500: __EH_prolog3_GS.LIBCMT ref: 00FE9507

Strings

CreateThread failed, xrefs: 00FF7658

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3_Thread$CreatePriority
String ID: CreateThread failed
API String ID: 3138599208-3849766595
Opcode ID: 5bbdf52304fc3cac574eca6b7b57269f87405a24bc7827fe8a43c39f9da6a705
Instruction ID: 6edf67b736dcb91295c51a5b58fc8551a01c7929c8bbf25a80afc918a2653cb0
Opcode Fuzzy Hash: 5bbdf52304fc3cac574eca6b7b57269f87405a24bc7827fe8a43c39f9da6a705
Instruction Fuzzy Hash: B201D6B13887096BE6207EA9DC81FB2B399EF41710F20051EF78696144CAF6B841973C

Function 01000405 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 0100042D
_wcslen.LIBCMT ref: 01000448

Strings

unknown_folder, xrefs: 01000442

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FolderPath_wcslen
String ID: unknown_folder
API String ID: 2987691875-3920786785
Opcode ID: b0e2f734eb849847a036bd395b567a5d848646eee26a3eaa367c2a9f57f30e35
Instruction ID: 7bd5f80a51e1d3eb734b92af02694a9f494e59db37330fc1b99cd797470faaf3
Opcode Fuzzy Hash: b0e2f734eb849847a036bd395b567a5d848646eee26a3eaa367c2a9f57f30e35
Instruction Fuzzy Hash: 1BF090B6601218BBEB11AF65DC44DFFB7ACEB44254F114066B845D7180DA349E099BA0

Function 00FEDE9A Relevance: 4.6, APIs: 3, Instructions: 115fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEDEA1
CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,00000024,00FEE8F5,?,?,00FEA6B9,?,00000011,?), ref: 00FEDF15
CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,?,?,00FED303,?,?,?), ref: 00FEDF65

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CreateFile$H_prolog3_
String ID:
API String ID: 1771569470-0
Opcode ID: bcdd75e2bb3d9ca17890a660c62913b0d885767750fc99bdc035f0a3a16b09a7
Instruction ID: ec96e95c0f39973669980ebecc7588ae26dc7a022f9dc6c2fab4782975992572
Opcode Fuzzy Hash: bcdd75e2bb3d9ca17890a660c62913b0d885767750fc99bdc035f0a3a16b09a7
Instruction Fuzzy Hash: 00418071C102889FDB14DFA9D88ABEEB7F4FF08320F10461EE456E7681D774A9409B21

Function 00FF6C5E Relevance: 4.6, APIs: 3, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FF6C65
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00FF6C9A
LoadLibraryW.KERNEL32(00000000,?,?,00000000,00000000,?), ref: 00FF6D0C

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: DirectoryH_prolog3_LibraryLoadSystem
String ID:
API String ID: 1552931673-0
Opcode ID: aad2720bf298f2fd0d0326f1b72fbeb6199cc9c0e27560e90053610bf1da12f0
Instruction ID: 3468943b6b729319a505d72f2d66eca1ada6aa8295e2657d78d865207434459d
Opcode Fuzzy Hash: aad2720bf298f2fd0d0326f1b72fbeb6199cc9c0e27560e90053610bf1da12f0
Instruction Fuzzy Hash: A5317872D0024CDADB05DBE5DC89BEEBBB8BF49314F20011AE645B7291EB385A44DB61

Function 00FEF58B Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEF592
SetFileAttributesW.KERNEL32(?,?,00000024,00FEA724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00FEF5A8
SetFileAttributesW.KERNEL32(?,?,?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049), ref: 00FEF5EB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AttributesFile$H_prolog3_
String ID:
API String ID: 2559025557-0
Opcode ID: 7bcb952a277c691aac676b4d0d34a83e23ff061c10f716ac67f7d44d38220692
Instruction ID: 50a5927c82ed0189a33ae751f2ba42bc2ec60ccfa2ae6cfc2cfd1f39ccfb65f6
Opcode Fuzzy Hash: 7bcb952a277c691aac676b4d0d34a83e23ff061c10f716ac67f7d44d38220692
Instruction Fuzzy Hash: 85115670D00209EBDF05DFA4E884AEEB7B8BF08310F14402AE440E7250DB38DA58DF24

Function 00FEEC63 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEEC6A
DeleteFileW.KERNEL32(?,00000024,00FED6F7,?), ref: 00FEEC7D
DeleteFileW.KERNEL32(00000000,?,00000000), ref: 00FEECBD

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: DeleteFile$H_prolog3_
String ID:
API String ID: 3558260747-0
Opcode ID: 07365f5f53d4867630eeff9016bd600b7ce611efb1a080727434e7978bbe6b8c
Instruction ID: 1e78aa90e36b974809c3a763058b78c8273ff423283a2e4165e1e4917239f023
Opcode Fuzzy Hash: 07365f5f53d4867630eeff9016bd600b7ce611efb1a080727434e7978bbe6b8c
Instruction Fuzzy Hash: 89114971D00219DBDF14DFA9E888AEEB7B9FF08310F14002AE444E3240DB34AA84DB64

Function 00FEED1F Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEED26
GetFileAttributesW.KERNEL32(?,00000024,00FEED16,00000000,00FEA4A1,3ACC59D7,?,00FECDDD,?,?,?,?,?,?,?,?), ref: 00FEED39
GetFileAttributesW.KERNEL32(?,?,?), ref: 00FEED79

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AttributesFile$H_prolog3_
String ID:
API String ID: 2559025557-0
Opcode ID: 93ecdf090a90c20a297e68e11cbd30109fcccf51f544b0694833a0229d8d164f
Instruction ID: 7eca4c4fb17746f85c563c5bc2df8b636c026d19d7c9c221f63f073effa6a4d0
Opcode Fuzzy Hash: 93ecdf090a90c20a297e68e11cbd30109fcccf51f544b0694833a0229d8d164f
Instruction Fuzzy Hash: 50114670D002189BDF15DFA8E9889EDB7F9FF48320F14042AE544F3380DB3499449B64

Function 00FEE3D5 Relevance: 3.1, APIs: 2, Instructions: 140COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?,?,00000000,?,00000000,00FEE3B1,?,?,00000000,?,?,00FECC21,?), ref: 00FEE55F
GetLastError.KERNEL32 ref: 00FEE56E

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 9a71a82aeea7305f9fa478ae1eedffd77266523f24569c3a9c52319948773a2f
Instruction ID: 1fc9cf99dd0aea6d8706a581bfdc613c47fd810cf6a57b88d5900874bf215eae
Opcode Fuzzy Hash: 9a71a82aeea7305f9fa478ae1eedffd77266523f24569c3a9c52319948773a2f
Instruction Fuzzy Hash: 47412539A043D5CBD730EF66E5846AAB3E5FF58330F14452DE88583281E779EC44ABA1

Function 010126D7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 01010005: GetLastError.KERNEL32(?,?,0100B581,?,0102E088,?,0100AE80,?,0102E088,?,00000007), ref: 01010009
Part of subcall function 01010005: _free.LIBCMT ref: 0101003C
Part of subcall function 01010005: SetLastError.KERNEL32(00000000,0102E088,?,00000007), ref: 0101007D
Part of subcall function 01010005: _abort.LIBCMT ref: 01010083

Part of subcall function 010127FE: _abort.LIBCMT ref: 01012830
Part of subcall function 010127FE: _free.LIBCMT ref: 01012864

Part of subcall function 0101246B: GetOEMCP.KERNEL32(00000000,?,?,010126F4,?), ref: 01012496

_free.LIBCMT ref: 0101274F
_free.LIBCMT ref: 01012785

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 0f521a71c6cd56d0b7ad2d704542cf3c049e8077756b448d468da5020b6db1ab
Instruction ID: 840f9f84258d980b14597b9ca63b8b198b73c99fb39ed001f8d97dbff45310cd
Opcode Fuzzy Hash: 0f521a71c6cd56d0b7ad2d704542cf3c049e8077756b448d468da5020b6db1ab
Instruction Fuzzy Hash: 96310831904209AFDB21EFA8D440BEEB7F5FF40320F354099E584AB298EB3A5D41CB40

Function 00FEE772 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 00FEE78C
SetFileTime.KERNEL32(?,?,?,?), ref: 00FEE840

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: ef8efa0cac368514f358942370c6d79d70e94e628e1444137ed79eb750eb9a65
Instruction ID: 116504d0c7d13576b09063c9d9d9fa422354ae25cfc5bade3d6b59c5b06e13b4
Opcode Fuzzy Hash: ef8efa0cac368514f358942370c6d79d70e94e628e1444137ed79eb750eb9a65
Instruction Fuzzy Hash: 38212631648385AFD725DE36D881AABBFE8AF95314F04491CF4D5C3141D329D90CE762

Function 00FEE850 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000001), ref: 00FEE897
GetLastError.KERNEL32 ref: 00FEE8A4

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3b7d56daf29b5b9cd475ba8b6b6a24dd3cf44ca11a642832a6fe289af498b1a1
Instruction ID: cdda99cf0235efda96d8f2282369ac4f1d129a90217f13144ce19f817e0bbeb7
Opcode Fuzzy Hash: 3b7d56daf29b5b9cd475ba8b6b6a24dd3cf44ca11a642832a6fe289af498b1a1
Instruction Fuzzy Hash: A2114831A40240AFF734D666DC4076673E9AB05370F600728F092D25C0D3B4FE45E760

Function 01003C78 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 01003C82
_wcslen.LIBCMT ref: 01003C99

Part of subcall function 00FF6A89: _wcslen.LIBCMT ref: 00FF6AA6

Part of subcall function 00FEB03D: __EH_prolog3_GS.LIBCMT ref: 00FEB044

Part of subcall function 00FEB3E1: __EH_prolog3_GS.LIBCMT ref: 00FEB3E8

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3__wcslen$H_prolog3_catch_
String ID:
API String ID: 1265872803-0
Opcode ID: 379a91b80d92effcb0ca1926f1a2a8e5c30c018bcc02f56b4524d37138e4b266
Instruction ID: 4fe41bf8a5744fe79295778fac43e46100c9f3fa892e9e461d2abff5b99f8523
Opcode Fuzzy Hash: 379a91b80d92effcb0ca1926f1a2a8e5c30c018bcc02f56b4524d37138e4b266
Instruction Fuzzy Hash: 011108359013D59ED715EB69DC11BDD3BBCAB1A310F00408EE4C4A72A7DBBD5A40EBA1

Function 00FE1CE2 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FE1CE9
GetDlgItem.USER32(?,?), ref: 00FE1D01

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3_Item_wcslen
String ID:
API String ID: 896027972-0
Opcode ID: 2ebbcf9506fba21f6aa75514052565ad933555ee081f412ca9fbd1f6c9714bb6
Instruction ID: b0a4ba27ecb43d79544cda1d60c7572361b0fed7dc8dce4f0071a50b22f8c2e3
Opcode Fuzzy Hash: 2ebbcf9506fba21f6aa75514052565ad933555ee081f412ca9fbd1f6c9714bb6
Instruction Fuzzy Hash: 93017171A402848AE725EF67CC45BEDB7A8BF54710F50011AE896A7191DB789A41EB10

Function 00FF76A7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(02000000,?,00000002,00000002,?,00FF76EA,00FF0B6F), ref: 00FF76B4
GetProcessAffinityMask.KERNEL32(00000000,?,00FF76EA), ref: 00FF76BB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 92580fe8cf4481841eba3c7a68dc2b0740a2ab20e66fe13aeb7c425750a6982b
Instruction ID: 50f60459e0531d7db7f788b99ea8be24321e30b24df99998b5383bf92bd966b2
Opcode Fuzzy Hash: 92580fe8cf4481841eba3c7a68dc2b0740a2ab20e66fe13aeb7c425750a6982b
Instruction Fuzzy Hash: 73E0D833F1460AA7DF1996AD9C059FBF2DDEE442543144179E653D3200F978DD0157A0

Function 00FFF53A Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,01019B73,000000FF), ref: 00FFF578
CoUninitialize.COMBASE(?,?,?,?,01019B73,000000FF), ref: 00FFF57D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 44f12180e91a1a5e7710d35979d8313accd6ca54189e9623cde5b83a38059bc3
Instruction ID: 6c95e2e2adc17a3804e0220223cdd15a1d13263acd2265e1343fdcb73ae0cbd1
Opcode Fuzzy Hash: 44f12180e91a1a5e7710d35979d8313accd6ca54189e9623cde5b83a38059bc3
Instruction Fuzzy Hash: EBF08276604514AFC721DF59EC45B9AFBECFB49630F00422AE556C3794CB79A800CB90

Function 00FFE849 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00FFE86A
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00FFE871

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: c338bfed29a9ddbaf82c76571ecdea2ddb93585b0569a95bff29f96305d2a553
Instruction ID: c245c0f7fdbee5bb9df134abee2c37521039125f180be0c60fb35eb2d90fa3f0
Opcode Fuzzy Hash: c338bfed29a9ddbaf82c76571ecdea2ddb93585b0569a95bff29f96305d2a553
Instruction Fuzzy Hash: F5E01271901218EFDB10EF95CD047EDBBF8EF08360F20845AA8C597650D674AE04EFA1

Function 00FE1E1F Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00FE1E34
ShowWindow.USER32(00000000), ref: 00FE1E3B

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 13c94ab1156c8327ea91f4bcf08d9a20684ceb18c7ae8370e281f68d7785dde5
Instruction ID: 87c1c3dfe715a319e964d623daf0880c719d1ec141213b2d128dbf3908c8f0af
Opcode Fuzzy Hash: 13c94ab1156c8327ea91f4bcf08d9a20684ceb18c7ae8370e281f68d7785dde5
Instruction Fuzzy Hash: ACC012B3058280BECB010BB4DC09D2ABBAEABA4212F00CA08B0E5C0054C23EC010EB11

Function 00FE27E0 Relevance: 1.8, APIs: 1, Instructions: 306COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FE27E7

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 477bda26a49c376d4bfaf1c67b12a59729226baa812c17b690fd300112f92416
Instruction ID: 7f28497efcf6d6a7bf25f285c3f59cc1ea7eb26cd11561d8978f2cb858aad7b8
Opcode Fuzzy Hash: 477bda26a49c376d4bfaf1c67b12a59729226baa812c17b690fd300112f92416
Instruction Fuzzy Hash: 98C1B330E042949BDF65CF66C8947ED7BE8AF45310F1810B9EC05DF286E7389945EBA1

Function 00FF9556 Relevance: 1.8, APIs: 1, Instructions: 258COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF97AB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: aac83d0d9a6fd029cb2684a8f6856942926378c3c583ba0aa4c9ecd64f721b75
Instruction ID: 21b63d23a52132998bbd5106243b8c970e3ebe18f06ea689c68e822f78e5e2cd
Opcode Fuzzy Hash: aac83d0d9a6fd029cb2684a8f6856942926378c3c583ba0aa4c9ecd64f721b75
Instruction Fuzzy Hash: A481487290C30D8FDB24EF64CC84BBAB7E4BF50310F14092EEA95971A0EBF499449B95

Function 00FE86F3 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f944f26a495f2bb0645a0f438d5594e605f59a9d6422d69678dd3f926acdbdd
Instruction ID: 59bec91a167b8924382bd863eb57c116d12feb87f2d666f87bcff7ca4d3ec094
Opcode Fuzzy Hash: 8f944f26a495f2bb0645a0f438d5594e605f59a9d6422d69678dd3f926acdbdd
Instruction Fuzzy Hash: CD7172B2504349ABD725EB64DC40EABB3EDFF84340F04492EF6C9D3141EA35E5059BA2

Function 00FEB544 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEB54B

Part of subcall function 00FEEFEF: __EH_prolog3_GS.LIBCMT ref: 00FEEFF6
Part of subcall function 00FEEFEF: CreateDirectoryW.KERNEL32(?,00000000,?,00000024,00FEEBA7,?,00000001,00000000,?,?,00000024,00FEA4DE,?,00000001,?,?), ref: 00FEF01F
Part of subcall function 00FEEFEF: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,00000024,00FEEBA7,?,00000001,00000000,?,?,00000024,00FEA4DE,?), ref: 00FEF075

Part of subcall function 00FEED1F: __EH_prolog3_GS.LIBCMT ref: 00FEED26
Part of subcall function 00FEED1F: GetFileAttributesW.KERNEL32(?,00000024,00FEED16,00000000,00FEA4A1,3ACC59D7,?,00FECDDD,?,?,?,?,?,?,?,?), ref: 00FEED39
Part of subcall function 00FEED1F: GetFileAttributesW.KERNEL32(?,?,?), ref: 00FEED79

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3_$AttributesCreateDirectoryFile
String ID:
API String ID: 3951278302-0
Opcode ID: eb8438e0c825677efb4fd875407066d07d3bc9e4d3e6ac1352bad59b9b19d26e
Instruction ID: 0b974388ff020ac08740fdeec692bb2f2507789827b461d0c2b2af7cd6133d3d
Opcode Fuzzy Hash: eb8438e0c825677efb4fd875407066d07d3bc9e4d3e6ac1352bad59b9b19d26e
Instruction Fuzzy Hash: D951C6715043846FDB25EB72CC85FFB3BB9AF42704F0801ADF985AA192CB689545E731

Function 00FE20B0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FE20B7

Part of subcall function 00FE80EC: __EH_prolog3.LIBCMT ref: 00FE80F3

Part of subcall function 00FF2815: __EH_prolog3.LIBCMT ref: 00FF281C

Part of subcall function 00FE76E7: __EH_prolog3.LIBCMT ref: 00FE76EE

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: d980ff3860dd836039242a062fb04497231e410312087fadfe50072d1caeaa7b
Instruction ID: 807d2eff18f137db07e530b82fe363f8cc0d736cec277314722d3bbf85e940bf
Opcode Fuzzy Hash: d980ff3860dd836039242a062fb04497231e410312087fadfe50072d1caeaa7b
Instruction Fuzzy Hash: 6F51F5B19057808EDB45DF2A88807C97BE0AF59300F0885BADD4DCF6ABE7740204DB61

Function 00FEB3E1 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEB3E8

Part of subcall function 00FEF711: FindClose.KERNEL32(00000000,000000FF,00000049,00000049,?,?,00FEA684,?,?,00000000,?,?,?,?,?,?), ref: 00FEF739

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CloseFindH_prolog3_
String ID:
API String ID: 2672038326-0
Opcode ID: 3d5016b919f42a7e308c21e6d7a082dbf49ed0e006683ceba3f34ae650025740
Instruction ID: a1d3bf8882f6ff1b76bd6d06fbe7baec807a141bae6ca4eea996f18749663d0b
Opcode Fuzzy Hash: 3d5016b919f42a7e308c21e6d7a082dbf49ed0e006683ceba3f34ae650025740
Instruction Fuzzy Hash: CD419270900789CFDB20DF6AD8C07AAB7F1BF05304F24442DE15A9B292D734A845EB25

Function 00FE2C30 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FE2C37

Part of subcall function 00FF880E: __EH_prolog3.LIBCMT ref: 00FF8815

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: 6b8a0d76e78afd060a1b6daf121f3795758d2870c60c8fa488925e9e6aac212b
Instruction ID: ad0efc9f0cb9f06dba2b7a5d0697fb5108369a99aba742e3eea6882ead5da981
Opcode Fuzzy Hash: 6b8a0d76e78afd060a1b6daf121f3795758d2870c60c8fa488925e9e6aac212b
Instruction Fuzzy Hash: 5E314C71D0128CAECF15EBEAEC819EEBBBDBF18350F14002AF505A3250DB349945EB20

Function 00FF97A4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF97AB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: c35e12dd63bd97b7a4f97188126d516bfcba54f89dc1942f76547ea1c5e04ac0
Instruction ID: a9e7cd18d1ae449248e07acdaa45c188363f1a06f7a77ad4ddb851cb3bd62781
Opcode Fuzzy Hash: c35e12dd63bd97b7a4f97188126d516bfcba54f89dc1942f76547ea1c5e04ac0
Instruction Fuzzy Hash: DA21F871D042169BFF28EF74CC45BAE76A4BF14354F05013AD645AB2D1D7B49940CBE4

Function 00FED771 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FED778

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 367480dc5d1cc553fd5eaf01f5f5503e5252f03234cf7b68663930604359b8d0
Instruction ID: 7ea8a82b056f21e76992e84d167a30b83ed48f801373d9fa19246ecd88d8da8c
Opcode Fuzzy Hash: 367480dc5d1cc553fd5eaf01f5f5503e5252f03234cf7b68663930604359b8d0
Instruction Fuzzy Hash: B021A772E0025A9BDB15DFEACC81AEFB7B9BF88350F14001AE504B7241CF789E009B95

Function 00FEEAF3 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEEAFA

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: bbf7ece72822e3e80ead2aa5ea27f793c57a7e728670e75ac19ede85ad1c2e58
Instruction ID: 43d208f9c70feab00f42fb231b4052bfd4f1f094a73b702235fce66fd00add17
Opcode Fuzzy Hash: bbf7ece72822e3e80ead2aa5ea27f793c57a7e728670e75ac19ede85ad1c2e58
Instruction Fuzzy Hash: B321D530A013889EDF209E66EC41EFE73A9FF91764F140548F482A7191D7789D49E760

Function 0101040E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0100535E,?,?,01006C16,?,?,?,?,?,01005269,0100535E,?,?,?,?), ref: 01010440

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 013837d6c54d088c9308951701e9d4fb56aebfce403c34fed06d568d0b93a768
Instruction ID: acc056dc92ac5b488917a0df27cda6f171adc898c7a05677dc0b1d54f133dd23
Opcode Fuzzy Hash: 013837d6c54d088c9308951701e9d4fb56aebfce403c34fed06d568d0b93a768
Instruction Fuzzy Hash: E5E065B118122697FAB226A99C44B9F3AC8AF411A0F194160FDC8DA1CDDF6DC88082A5

Function 00FEF711 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00FEF826: __EH_prolog3_GS.LIBCMT ref: 00FEF830
Part of subcall function 00FEF826: FindFirstFileW.KERNEL32(?,?,00000274,00FEF733,000000FF,00000049,00000049,?,?,00FEA684,?,?,00000000,?,?,?), ref: 00FEF859
Part of subcall function 00FEF826: FindFirstFileW.KERNEL32(?,?,?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049), ref: 00FEF8A4
Part of subcall function 00FEF826: GetLastError.KERNEL32(?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049,?,00000000), ref: 00FEF902

FindClose.KERNEL32(00000000,000000FF,00000049,00000049,?,?,00FEA684,?,?,00000000,?,?,?,?,?,?), ref: 00FEF739

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorH_prolog3_Last
String ID:
API String ID: 765066492-0
Opcode ID: 26c1aa908caf02f5f18b40d7cbe651798641adde9b8cea80df9c95507cb5188f
Instruction ID: fcc8975cdd563b0881d360dc5a81bf9b5af2fe5217e256822b9093528bebdbfd
Opcode Fuzzy Hash: 26c1aa908caf02f5f18b40d7cbe651798641adde9b8cea80df9c95507cb5188f
Instruction Fuzzy Hash: D9F0A7314097D0AECE311F755C04A8B7FD06F17370F004B09F0F952192C2399059EB22

Function 00FF51BF Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FF51E3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 48648755bf74cb7012a9fb0e130f506d7f1f9963482c6aafffa6f80ed102a878
Instruction ID: 242860bf8af49410e306f59f404c5cef8e09e583a29f91ec6b0cb3b174112617
Opcode Fuzzy Hash: 48648755bf74cb7012a9fb0e130f506d7f1f9963482c6aafffa6f80ed102a878
Instruction Fuzzy Hash: 5EE048311005456AD3219A1D9C44E7BB7E9AF91B20F15841DF68487191CBB9A8819AA0

Function 00FF73F8 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00FF742D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 74186e41858e475be6abc292371a936064f60496eb2340d26247d4739481e6d5
Instruction ID: 8ae6c2d7304b2e69413e11369719b8726e8f1caa524ccb0c4968877b49d034e1
Opcode Fuzzy Hash: 74186e41858e475be6abc292371a936064f60496eb2340d26247d4739481e6d5
Instruction Fuzzy Hash: A6D0C210A4815022EA267625ACC57FD39064F82361F08002AF24453193CA9D0C87B3B6

Function 00FE11DD Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00FE1206

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6fab89e8f1c091a11cb7505222baaf35541e953dbe2c5a729950a3504203906d
Instruction ID: 79e957f0b7b0b4210dc2f9b41693eec399835730e0ba46992520c654f2f66fd3
Opcode Fuzzy Hash: 6fab89e8f1c091a11cb7505222baaf35541e953dbe2c5a729950a3504203906d
Instruction Fuzzy Hash: CAD05EB6A026474E872DEB36DC65C6E72916E64315711423DE12ACB680DF35CC15E714

Function 00FFEB06 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00FFEB0C

Part of subcall function 00FFE849: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00FFE86A

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
Instruction ID: 70e9ec7bc9a7864c488815c4a31e028dea7c811b3d0328b229846de9505bfbae
Opcode Fuzzy Hash: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
Instruction Fuzzy Hash: CAD0C73160020EB6DF466B619C1197E7995DF55350F008525AA46951B0E9B1D910B551

Function 01004231 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 01004256

Part of subcall function 01000678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 01000689
Part of subcall function 01000678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0100069A
Part of subcall function 01000678: IsDialogMessageW.USER32(0001040E,?), ref: 010006AE
Part of subcall function 01000678: TranslateMessage.USER32(?), ref: 010006BC
Part of subcall function 01000678: DispatchMessageW.USER32(?), ref: 010006C6

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 91c66ccbcdfc780d73afb55e86b9fda693be600d7759c586656ed50a0c69b100
Instruction ID: f7b5395b412cb73bbe9a5eb7d68c3b0c5518e439bccbccaf4e1ac04e150f713b
Opcode Fuzzy Hash: 91c66ccbcdfc780d73afb55e86b9fda693be600d7759c586656ed50a0c69b100
Instruction Fuzzy Hash: 80D09E75144200AAD6122B51CE0AF1A7AE6AB9CB04F104554B789740F5CA669E20EB12

Function 01004D2C Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01004DD5: RtlAcquireSRWLockExclusive.NTDLL ref: 01004DF2

DloadProtectSection.DELAYIMP ref: 01004D54

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AcquireDloadExclusiveLockProtectSection
String ID:
API String ID: 3680172570-0
Opcode ID: 154710861a97a87cf2d04d8b174dda210443cf47e49544d31fad0d63dc1a7059
Instruction ID: 1c59b7f9722f692a434ace21506d7a1e9b44c05dcbc0954fc8eedfa6bbf0847e
Opcode Fuzzy Hash: 154710861a97a87cf2d04d8b174dda210443cf47e49544d31fad0d63dc1a7059
Instruction Fuzzy Hash: 06D012745042619EF773BB28EC4E7582394B304344F800586E3D5C51F8CF7A40529709

Function 00FEE152 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(000000FF,00FEE052,?,?,?,00000000,00FEE5D2,?,?,00000000,?,00000000), ref: 00FEE15E

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 78df813175755c3701d9cd2da264d7b6cf422c1bd89fc0cc531ea8a891b704fd
Instruction ID: f2768e061632013847776420118125b700048a01e6aa8c0c93a6c4f36d631eeb
Opcode Fuzzy Hash: 78df813175755c3701d9cd2da264d7b6cf422c1bd89fc0cc531ea8a891b704fd
Instruction Fuzzy Hash: 32C0023480028ADA9E314A2AB9494997622AB533B67B49794D069895B1C33B8CDBFA11

Function 00FF4F88 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00FF4F92

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 5c51bc102b493bf9795bfeec33c0dc927d810e6ce96b5d7da5da0631409e4aa6
Instruction ID: 219a4bc9d67b740bf395a5d58bdb3359d987bde973328b2f5e008fc3781aa2ad
Opcode Fuzzy Hash: 5c51bc102b493bf9795bfeec33c0dc927d810e6ce96b5d7da5da0631409e4aa6
Instruction Fuzzy Hash: AFD0C970424211CFD7718F38E404742BBE0AF08321B11882E90CDC2264E2759880CF40

Function 01004906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 682326aba6fc9bd1007e2a46dc6f372dcfd4ec81c694a49ecad1426e5a02315a
Instruction ID: b7465df71185bb8cdb756f00e99dcc0c5993576e6f0473a37270343347a41cd1
Opcode Fuzzy Hash: 682326aba6fc9bd1007e2a46dc6f372dcfd4ec81c694a49ecad1426e5a02315a
Instruction Fuzzy Hash: 12B012D225D0127C320511157F05C3A110DC0D1910720451EF9C0C4092D8425D85003A

Function 01004921 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5a267eb62e2d5413fa32c499a1d5f6c145161e481eeb200eb3f50617dcf6c2d3
Instruction ID: 3935da52f37409393b3df50ed07bc60a05257c1e59c4c780bd1d7b76c8655df9
Opcode Fuzzy Hash: 5a267eb62e2d5413fa32c499a1d5f6c145161e481eeb200eb3f50617dcf6c2d3
Instruction Fuzzy Hash: 56B012C225D1126C33495119BE05C3A111DC0D1910720471EF5C0C5081D4804CC40039

Function 0100492B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 531f3051ec6726bf57697c7a5fcd09926b7532170721a616f389053317268eba
Instruction ID: b5bf8da663eb368855bbd9c80c0870657ac99c9fdabb8d18e641c0570edc1cbb
Opcode Fuzzy Hash: 531f3051ec6726bf57697c7a5fcd09926b7532170721a616f389053317268eba
Instruction Fuzzy Hash: 50B012C225D0126C32095119BF05C3A111DC0D1910720471EF9C0C5081D4414D850039

Function 01004935 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 39840012f9a194e150ab29bfe2436853f785aba64db047a456c27d56efac8a13
Instruction ID: 0a142307657f130393c9b9529da17be80e73f94015073b9c6921f86a3de497c3
Opcode Fuzzy Hash: 39840012f9a194e150ab29bfe2436853f785aba64db047a456c27d56efac8a13
Instruction Fuzzy Hash: 8EB012C226D1166C32095119BE05C3A111DD0D1910720461FF5C0C5081D4408C840039

Function 0100493F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba75fbdb4183259a9dccd4a8c378dc960605c813fc8f58c6908a82ea23f35f2a
Instruction ID: cf695089c6c3462a3f32a514539a34e2becf0b37b78fb9f0b217401c7ff931d9
Opcode Fuzzy Hash: ba75fbdb4183259a9dccd4a8c378dc960605c813fc8f58c6908a82ea23f35f2a
Instruction Fuzzy Hash: F2B012C625D1126C320551197E45C3B114DC0D2910720851EFDC0C5181D4405C840035

Function 01004949 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b939138d13de0d8dbef510c49264437e8b2bbe16c0e2ed9cee63de904bbb01c4
Instruction ID: 506c3809099eea32493df4dca7e8b47f32efefcb9ba771795b2c0ac0df0762be
Opcode Fuzzy Hash: b939138d13de0d8dbef510c49264437e8b2bbe16c0e2ed9cee63de904bbb01c4
Instruction Fuzzy Hash: C3B012C625D2126C334551197E45C3B110DC0D1910720461EF9C0C5181D4804CC40035

Function 01004953 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb4478f02c7f15b049191fb2b55c00d134d680b2a17ce7da26dfae0f06dffa8e
Instruction ID: 82ca8056d26b8c7ad0d8bfc632b0bcb1a4887719ab7d98ba7be0dc2c4b6171bd
Opcode Fuzzy Hash: eb4478f02c7f15b049191fb2b55c00d134d680b2a17ce7da26dfae0f06dffa8e
Instruction Fuzzy Hash: E4B012C625D2126C320551197F45C3B110DC0D1910720451EFDC0C5181D4414E850035

Function 0100495D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 59f2e3096302c2b9af893d4403328ebd64a29321290bcfccf665801b609f4d25
Instruction ID: 2528bc8158124fc60c455cc460d7fa8e03bf224d6b6211923606c567c74ee7ae
Opcode Fuzzy Hash: 59f2e3096302c2b9af893d4403328ebd64a29321290bcfccf665801b609f4d25
Instruction Fuzzy Hash: 91B012C625D11A6C320551197E45C3B110DD0D1910720451EF9C0C5181D4404C840135

Function 01004967 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a908c60f01318f578bf2487c6df5e145d9e87986166b47776832231fd349f230
Instruction ID: b51873d7e592ae4c6fe6bff421fd536ca1701f3be327ee08bfb63c600fb82c61
Opcode Fuzzy Hash: a908c60f01318f578bf2487c6df5e145d9e87986166b47776832231fd349f230
Instruction Fuzzy Hash: 35B012C225D0136C320955197E05C3A114DC0D3920720C51EF9C0C5181D4404C8C0035

Function 0100497B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0cf4e0e10285184214122057009087f02c18c90ffd2798a4e5f2d265aa1e81b0
Instruction ID: db5c5ca829c40535eb935009c94f5bd07f56a561cb970063a89bf9f2a3edb1d8
Opcode Fuzzy Hash: 0cf4e0e10285184214122057009087f02c18c90ffd2798a4e5f2d265aa1e81b0
Instruction Fuzzy Hash: 77B012C225D0126C3209511A7F05C3A110DC0D2920720851EF9C0C5181D4414D8D0035

Function 01004985 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 692133dc42b94afd5a9589e400413e86e8957a02f98b0fb4f79e07dcf6774757
Instruction ID: 2f4fd3c84544b287f84e5f6ee9f9229fba83465d44f9fd8f0062e0defbc51e6e
Opcode Fuzzy Hash: 692133dc42b94afd5a9589e400413e86e8957a02f98b0fb4f79e07dcf6774757
Instruction Fuzzy Hash: 18B012C225D0166C320951697E05C3A110DD0D2920720891EF5C0C5181D4404C880035

Function 0100498F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2d7a991e7c1c026aad261e06fb47f20f3664a53fab055f6e350756cb37364991
Instruction ID: f9d0f72eefadbd3a02c9712837ddeafafc89d7912005bce557f67881f9f829a1
Opcode Fuzzy Hash: 2d7a991e7c1c026aad261e06fb47f20f3664a53fab055f6e350756cb37364991
Instruction Fuzzy Hash: E9B012D225D0126C3205511A7E05C3A115DC0D2A10720951EF9C0C5081D4404D840035

Function 01004999 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ae4a383e42ba94d80fe4f5de67c0a105a67be003319e96d05eeb3eec92a061cc
Instruction ID: 9ce1802defa33699b91d12c1ea7e15b08942398e78272cd49d3e4b78b791ea99
Opcode Fuzzy Hash: ae4a383e42ba94d80fe4f5de67c0a105a67be003319e96d05eeb3eec92a061cc
Instruction Fuzzy Hash: F9B012D225D1126C3345511A7E05C3A111DC0D1A10720561EF5C0C5081D4804DC40035

Function 010049A3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 900900073346610e888d99db878c2cb15bab9c10efc44f775b1d45a751e4f614
Instruction ID: f5d4ee4581bc987c2457d70066b13e48989a56f953dd5dfcfadac13cc1393a86
Opcode Fuzzy Hash: 900900073346610e888d99db878c2cb15bab9c10efc44f775b1d45a751e4f614
Instruction Fuzzy Hash: 34B012D225D0126C3205511A7F05C3A111DC0D1A10720551EF9C0C5081D4414E850035

Function 010049B7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5f2c48033ae0a2eaa7e21cea77558f2f5816cb5d8f00b32daa4a493988b237a5
Instruction ID: 3bdd0e872b968a43a7876db2b96e1695c1e0007cb6ee48e4997c29b8a3b3667a
Opcode Fuzzy Hash: 5f2c48033ae0a2eaa7e21cea77558f2f5816cb5d8f00b32daa4a493988b237a5
Instruction Fuzzy Hash: 72B012C635E0126C320551197E05C3A114EC0D2910B20851EF9C0C50C1D4404C840035

Function 010049C1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6ab7108eb4ca59681ba6731be0d0c2398654e05a38146f981fc973a86cb5e21e
Instruction ID: e5ac0f9034c305a2d5e2ba55f8a7916477a0a8f99689f43b8487f5ee16e3a37c
Opcode Fuzzy Hash: 6ab7108eb4ca59681ba6731be0d0c2398654e05a38146f981fc973a86cb5e21e
Instruction Fuzzy Hash: B9B012D625E1126C334552197E05C3A110EC0D1910B20461EF5C0C5081D4804CC40035

Function 010049D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: caed65e960c8ac8bb60c70aad3d1289b339c7b41fd16faa44bb141bcd98c9018
Instruction ID: 378ec15524cb9bec62c32c5d86e4649381ee28b2f96783d1f87b385aa68ad3b0
Opcode Fuzzy Hash: caed65e960c8ac8bb60c70aad3d1289b339c7b41fd16faa44bb141bcd98c9018
Instruction Fuzzy Hash: 23B012C626E0166C320551197E05C3A114FD4D1910B20451EF5C0C5081D4404C840035

Function 01004B58 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e01fa199441d10257bff93ebb39d349578fc107d277a94d3d4ab519c8f9c8718
Instruction ID: d9d0483be9ab00585439ac7abf298a5361596ac428397b825e2df41a51a874bf
Opcode Fuzzy Hash: e01fa199441d10257bff93ebb39d349578fc107d277a94d3d4ab519c8f9c8718
Instruction Fuzzy Hash: EAB012C525D111AC3109510A9E46D3B214CC0D1911720630EF5C0C50C0D4401C880039

Function 01004B62 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cdb402ba6a3fa60b3f0bf2ddbb08850b3dfec0413b54f4b1fc2d19f34ed9be71
Instruction ID: 0143d04f7cfe37a9df973887628173fcc777022c463a687502e106fb57518389
Opcode Fuzzy Hash: cdb402ba6a3fa60b3f0bf2ddbb08850b3dfec0413b54f4b1fc2d19f34ed9be71
Instruction Fuzzy Hash: ACB012C525D011AC3009510A9F06D3B214CC0D1911720A30EF6C0C5080D4401C450039

Function 01004B8A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7dedf0876ac0a48b4873131c36e764610d361b6191ccd628c87e2ba1e3ce6644
Instruction ID: 2ce399f704e10f88c8df11489b51bcf35b1f941efc8056866d3d0a467b370c91
Opcode Fuzzy Hash: 7dedf0876ac0a48b4873131c36e764610d361b6191ccd628c87e2ba1e3ce6644
Instruction Fuzzy Hash: 81B012C525D111EC3005510A5E56D3B218CC0D1911720A10EF9C0C5180D4401C440035

Function 01004A07 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0bca1e50fb36fc7e450ecb0d2d1e0881a64b49a9b0ac0a599c4ff6cfc560972c
Instruction ID: b2c8e24f9f137b9845d4f5a9844a80cb75483ee2c855759997345ab6ee1a046e
Opcode Fuzzy Hash: 0bca1e50fb36fc7e450ecb0d2d1e0881a64b49a9b0ac0a599c4ff6cfc560972c
Instruction Fuzzy Hash: 4DB012C225D0126C320551197E07C3A124DC0D2910720891EFAC0C9081D4404C840035

Function 01004D04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004CF1

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0c23ead12c599c28d0ca82e05ba73b3e52ece05869e744a19005267d58b0e193
Instruction ID: 5a7630f63be6dd1d61eb0e6af65dae86a28ac0ecd25b044a97f6d4424f634776
Opcode Fuzzy Hash: 0c23ead12c599c28d0ca82e05ba73b3e52ece05869e744a19005267d58b0e193
Instruction Fuzzy Hash: B9B012C625D1166C3186610A5E05C3E114DD0E2910721421FF2C0C5080D5810C890035

Function 01004D18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004CF1

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 16077039ee9c3544f9bf02d9df476d4ae1fd72f52a05edcd1e4977ab2e40b525
Instruction ID: 2bc61943dc52256a2a1f0ecbee4cf8ae28a00be35524cc549b2354f302a941d1
Opcode Fuzzy Hash: 16077039ee9c3544f9bf02d9df476d4ae1fd72f52a05edcd1e4977ab2e40b525
Instruction Fuzzy Hash: 1CB012C625D0167C3046610A5E05C3E11CDD0E2910721810FF5C0C6080D4400C4C0036

Function 01004D22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004CF1

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d4af6868e75db2568d3ac268a26d1312e7e3f9ed2b60b52775434db2b4e846ea
Instruction ID: 349a96296c431d6a7b36541fe4d704ba6d28769bbc212386be338da69eba9b2d
Opcode Fuzzy Hash: d4af6868e75db2568d3ac268a26d1312e7e3f9ed2b60b52775434db2b4e846ea
Instruction Fuzzy Hash: 12B012C625D01B6C3046610A5E05C3E114DE0E2910721411FF2C0C5080D5400C490035

Function 01004C7E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0a19925a8488d0f51493f5b7db485f25eb793d9ec91556568ef676ed09f11963
Instruction ID: c0b4c69c6c7c5bd330e22c04894b0eb15cc4690db35f6027d71b9124a8269a5a
Opcode Fuzzy Hash: 0a19925a8488d0f51493f5b7db485f25eb793d9ec91556568ef676ed09f11963
Instruction Fuzzy Hash: 0FB012C929D119FC314521055F05C3A110CC9F1911B31820EF2C0C4081D8400C450035

Function 01004C99 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 07e8fb04e77c583b944cc8da9716fa62bf33cb948d152844b2c625b754232c14
Instruction ID: 49228800dde6f9b3b4bdd4274bfe572e9b250f603a06251490298269230f2a0c
Opcode Fuzzy Hash: 07e8fb04e77c583b944cc8da9716fa62bf33cb948d152844b2c625b754232c14
Instruction Fuzzy Hash: 98B012C525D019EC314561255E05C3B118CC1D3910731811EF6C0C5081D8400C480035

Function 01004CB7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 20337dcf500a6084e9e6d73050962c1de29d6b7951bf74a944b27f151e6590ae
Instruction ID: ac2a3c6a8e24253b6b584f612b2d558698c4c4634eb697df6acc57f8d23c9c2d
Opcode Fuzzy Hash: 20337dcf500a6084e9e6d73050962c1de29d6b7951bf74a944b27f151e6590ae
Instruction Fuzzy Hash: BCB012C525D01EEC314561155F05D3A114CD1D2910731411EF2C0C5481D8400C480035

Function 01004CCB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 105c0445956d5053df1a3ffb6fea6530b20d67d61df5ead9c64dd44e7d69ffcf
Instruction ID: e79c131cc7501a4d2516f72a40f046a0f4bc1fecbcdab330c9fc6d0d0c7e5ff4
Opcode Fuzzy Hash: 105c0445956d5053df1a3ffb6fea6530b20d67d61df5ead9c64dd44e7d69ffcf
Instruction Fuzzy Hash: 25B012C526D119FC324561055E45C3A114CC1D1910731420EF1C0C50C0D8400C880036

Function 01004CD5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: beb1a04df4079c262acf56675b1f0656638266fc13d97098c761a68e78778447
Instruction ID: c1f0f10782ff758db6874d5c27fb01b1eafe5632c52751631c2d3c25c2499d6a
Opcode Fuzzy Hash: beb1a04df4079c262acf56675b1f0656638266fc13d97098c761a68e78778447
Instruction Fuzzy Hash: 84B012C525E11DEC318561055F05D3A114CD5D1910B71410EF1C0C5080E8400C440035

Function 01004CFA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004CF1

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb017827dd6fa80b2bf95be0eaec7032a01e78808c2a7d0384e7c6720bcdd87c
Instruction ID: d1965f253738a6b3bbf5f614378819b72cf057247d50c70a76370aee0455d6ae
Opcode Fuzzy Hash: eb017827dd6fa80b2bf95be0eaec7032a01e78808c2a7d0384e7c6720bcdd87c
Instruction Fuzzy Hash: 26B012C625F01A6C3086610A5E05C7E114DE4E1910721410FF1C0C5080E4400C480035

Function 00FF2226 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00FF2233

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 49502b7a1dc4d77950889bae7bd842ca38e52f0410a440c09ff33177ec0a2fa9
Instruction ID: f3261a0da216f47b5e22037bc6efc91bdd280203aa701034e5aee2a35f0cfcea
Opcode Fuzzy Hash: 49502b7a1dc4d77950889bae7bd842ca38e52f0410a440c09ff33177ec0a2fa9
Instruction Fuzzy Hash: 33C04870641200DFA704CFA8DA8CA0A77AABFA2706B4184A8F580CB024C738DC60EB25

Function 01004976 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ea6149c0c57b5691474480bf12b56afd9fd9d0f56e10aaf46a7eccdb8dca2c31
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: ea6149c0c57b5691474480bf12b56afd9fd9d0f56e10aaf46a7eccdb8dca2c31
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 010049B2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 914b4c5541dcd12726cf0256bd970a963c453879524ed787357fa1338954c4bc
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: 914b4c5541dcd12726cf0256bd970a963c453879524ed787357fa1338954c4bc
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 010049D0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b4c1aa824d50c0bce1d49b6666493efad611f207058a19ba8a4f4c8543b2ae1a
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: b4c1aa824d50c0bce1d49b6666493efad611f207058a19ba8a4f4c8543b2ae1a
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 010049E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: abdae75498ddf2f93dcb0a7bc6883f041755c566983099729363d5ac439c59fb
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: abdae75498ddf2f93dcb0a7bc6883f041755c566983099729363d5ac439c59fb
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 010049EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f48e57a7e754185440877d13f65ab6bf8bc652c796066ef42e0b07fb1ec73084
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: f48e57a7e754185440877d13f65ab6bf8bc652c796066ef42e0b07fb1ec73084
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 010049F8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7bdf6412e4c797955ea13166d2c1e87a0ae756bd3f2deab4fa86770f065ac5a2
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: 7bdf6412e4c797955ea13166d2c1e87a0ae756bd3f2deab4fa86770f065ac5a2
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 01004B2E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 93d8807f3571abc854c0a7b3914a14ced2cd0f05a11134a3ccf08897b22784f4
Instruction ID: 41a0eef5a5902ff01cf510dea200728465e35f479ce63258972d6e32a37acf0d
Opcode Fuzzy Hash: 93d8807f3571abc854c0a7b3914a14ced2cd0f05a11134a3ccf08897b22784f4
Instruction Fuzzy Hash: 65A004D515D5157C310555577F57D7F115DC4F1F11731751DF5C1D50C5D4501D450035

Function 01004B49 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d864dea78d0e98352c7a5bc5eabfa0796f1c24336c0fa1e012b9280d067bdd91
Instruction ID: 199fa2248dee880e3085c95f3e0e1ea21cc0bb25154cf819370b44234fd7e95a
Opcode Fuzzy Hash: d864dea78d0e98352c7a5bc5eabfa0796f1c24336c0fa1e012b9280d067bdd91
Instruction Fuzzy Hash: 6FA004D515D5177C310555575F57D7F115DC4D5D51731751DF5C1C50C5D4401D450035

Function 01004B53 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d47b068b7add73f7903be2c56969db72597532d6779342f539011bccada9282a
Instruction ID: 199fa2248dee880e3085c95f3e0e1ea21cc0bb25154cf819370b44234fd7e95a
Opcode Fuzzy Hash: d47b068b7add73f7903be2c56969db72597532d6779342f539011bccada9282a
Instruction Fuzzy Hash: 6FA004D515D5177C310555575F57D7F115DC4D5D51731751DF5C1C50C5D4401D450035

Function 01004B71 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 97d43bcbe4865794aa61170c64a488b6994d017832be057476451ccf4fe797a7
Instruction ID: 199fa2248dee880e3085c95f3e0e1ea21cc0bb25154cf819370b44234fd7e95a
Opcode Fuzzy Hash: 97d43bcbe4865794aa61170c64a488b6994d017832be057476451ccf4fe797a7
Instruction Fuzzy Hash: 6FA004D515D5177C310555575F57D7F115DC4D5D51731751DF5C1C50C5D4401D450035

Function 01004B7B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f9aca493ef5b9a37af7a22130a1df69cf91567cd65b7813ed0f2265b18d1b73a
Instruction ID: 199fa2248dee880e3085c95f3e0e1ea21cc0bb25154cf819370b44234fd7e95a
Opcode Fuzzy Hash: f9aca493ef5b9a37af7a22130a1df69cf91567cd65b7813ed0f2265b18d1b73a
Instruction Fuzzy Hash: 6FA004D515D5177C310555575F57D7F115DC4D5D51731751DF5C1C50C5D4401D450035

Function 01004B85 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004B3B

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: be2847a62fc41fb97af7acb6fa1898f9357c713abc197bc56c52a036e2e39607
Instruction ID: 199fa2248dee880e3085c95f3e0e1ea21cc0bb25154cf819370b44234fd7e95a
Opcode Fuzzy Hash: be2847a62fc41fb97af7acb6fa1898f9357c713abc197bc56c52a036e2e39607
Instruction Fuzzy Hash: 6FA004D515D5177C310555575F57D7F115DC4D5D51731751DF5C1C50C5D4401D450035

Function 01004A02 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004918

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 03d672370eec4ab275b36c8d37ba8e23cf1a30f435ed7a2840648159645f6801
Instruction ID: 440de7453f6b9bd0b9aec815f4e2196be87608848161fafaa4374ce5f76bcb95
Opcode Fuzzy Hash: 03d672370eec4ab275b36c8d37ba8e23cf1a30f435ed7a2840648159645f6801
Instruction Fuzzy Hash: 8BA004D555D1177C330551517F45C7F111DC4D5D517315D1DF5C1C54D1D4415DC50035

Function 01004D13 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004CF1

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fab55c8e92b4c1ec918344f2137cd2bc0d034bc95b18da70055efafe5c4efe3d
Instruction ID: 753e16c74e86cd168c4b3b5d164fa53557898251caf1576fb2008090adbc165d
Opcode Fuzzy Hash: fab55c8e92b4c1ec918344f2137cd2bc0d034bc95b18da70055efafe5c4efe3d
Instruction Fuzzy Hash: E4A001DA2AE52BBC314A62526E4AC7E125DD4E6A61B229A1EF682C9091E99118890039

Function 00FE1DE7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,?), ref: 00FE1DFC

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 5bd3a4f4de159101e0d51a9f53e74b59ace8c38fedf413e65b76633629bc1aa7
Instruction ID: bb90b5cdaf5b8320fbe6ad997bb584a395060a27d8b14d6b241310e8e4299c4c
Opcode Fuzzy Hash: 5bd3a4f4de159101e0d51a9f53e74b59ace8c38fedf413e65b76633629bc1aa7
Instruction Fuzzy Hash: 8BC00271508240FFCB15CF59D948D1ABBB6FB95311B51C568F09486024C331D920DB62

Function 01004CA8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 91b8925518a744b09556b1dde33cd976f2af6ce7905515c1b15305460473cdaa
Instruction ID: 159e25a9c15586a8f2c397e67fba60ba0c6eaae590f60d4fa562204aac1e560f
Opcode Fuzzy Hash: 91b8925518a744b09556b1dde33cd976f2af6ce7905515c1b15305460473cdaa
Instruction Fuzzy Hash: 3FA002D62AE12FFC324A72526F4AC7F125DC5E6E61B729A1EF6C2C94C1EC801C890039

Function 01004CB2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fd4d720c3ee8ccee655406fe691f86fd8a7fa34ab0b3e326e47f7c28ec55477b
Instruction ID: 159e25a9c15586a8f2c397e67fba60ba0c6eaae590f60d4fa562204aac1e560f
Opcode Fuzzy Hash: fd4d720c3ee8ccee655406fe691f86fd8a7fa34ab0b3e326e47f7c28ec55477b
Instruction Fuzzy Hash: 3FA002D62AE12FFC324A72526F4AC7F125DC5E6E61B729A1EF6C2C94C1EC801C890039

Function 01004CC6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004C90

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 87d57f04fcbe58be6765cf1c87ba7a7d096bd62f414326d7561df719d5e936b1
Instruction ID: 159e25a9c15586a8f2c397e67fba60ba0c6eaae590f60d4fa562204aac1e560f
Opcode Fuzzy Hash: 87d57f04fcbe58be6765cf1c87ba7a7d096bd62f414326d7561df719d5e936b1
Instruction Fuzzy Hash: 3FA002D62AE12FFC324A72526F4AC7F125DC5E6E61B729A1EF6C2C94C1EC801C890039

Function 01004CE4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01004CF1

Part of subcall function 01004FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 01005041
Part of subcall function 01004FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01005052

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d820316edc3dc80764a73fa1e1174d47aa529a2795bb4b046ef3bf35f2e567cd
Instruction ID: 07ed99e94c21b2a394cdb49ed0230a6374a0afc4d0b2f97ee3ae29614e3dd5e8
Opcode Fuzzy Hash: d820316edc3dc80764a73fa1e1174d47aa529a2795bb4b046ef3bf35f2e567cd
Instruction Fuzzy Hash: CEA011CA2AA02ABC300A22022F0AC3E020CC0E2A20B22820EF280C8080E88008880038

Function 00FE1E05 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 00FE1E16

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: f66a15f591a477f07af8364bef0d67131e30f66d61b98b7707ec6cd22fa71c00
Instruction ID: 3948ec29edf5a10facd4f7f7b3d9c95d512334b202c91e83ca08b7ecf8b851b4
Opcode Fuzzy Hash: f66a15f591a477f07af8364bef0d67131e30f66d61b98b7707ec6cd22fa71c00
Instruction Fuzzy Hash: 1BC04871204201EFDB04DF19D988D1BBBAAFB91342B018469F884CB134C335ECA4EB22

Function 00FEE8D9 Relevance: 1.5, APIs: 1, Instructions: 5fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,00FED115,?,?,?,?,?,?,?), ref: 00FEE8DC

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: c6b68f39b24f2281afad558e07b3bcbbf2c0a6b4b50f59164deb61f0bb7145b5
Instruction ID: 5e0c6696c3a93523768db485190000a3a06bbe287db12803b7c9666db9453b10
Opcode Fuzzy Hash: c6b68f39b24f2281afad558e07b3bcbbf2c0a6b4b50f59164deb61f0bb7145b5
Instruction Fuzzy Hash: 19A001302411058BAA525A21DA0960E7A6AAE4269971980A8A44989065DB2BC8A2AA41

Function 00FEDE50 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000001,00FEDE10,3ACC59D7,?,00000000,010193B1,000000FF,?,00FEBEA6,?), ref: 00FEDE6B

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c164b4b540de3b9a17c5973b3d93e5411869b46e099411c63e10f95f4a9dd8d0
Instruction ID: c634b95b46a455238873ff01af6f4f4f0b4fc823c3882ae5f89354aba0298a30
Opcode Fuzzy Hash: c164b4b540de3b9a17c5973b3d93e5411869b46e099411c63e10f95f4a9dd8d0
Instruction Fuzzy Hash: B8F0A770842B819BE7349E36C448352B7E46B21334F044B0EE0F6469E4C375A989AB50

Non-executed Functions

Function 00FE9B5C Relevance: 23.3, APIs: 9, Strings: 4, Instructions: 577fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FE9CB1

Part of subcall function 00FEAC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00FEAC2E
Part of subcall function 00FEAC11: GetLastError.KERNEL32 ref: 00FEAC72
Part of subcall function 00FEAC11: CloseHandle.KERNEL32(?), ref: 00FEAC81

Part of subcall function 00FE2F45: _wcslen.LIBCMT ref: 00FE2F50

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,?,00000000,?,00000001,?,00000000,00000000,?,\??\), ref: 00FE9EE1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,3ACC651F,01019937,000000FF), ref: 00FE9F1E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000,?,00000000,?,00000000,?,00000001,?,00000000,00000000), ref: 00FEA0BF

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00FEA127
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,3ACC651F,01019937,000000FF), ref: 00FEA134
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,3ACC651F,01019937,000000FF), ref: 00FEA14A
RemoveDirectoryW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,3ACC651F,01019937,000000FF), ref: 00FEA18E
DeleteFileW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,3ACC651F,01019937,000000FF), ref: 00FEA196

Strings

SeRestorePrivilege, xrefs: 00FE9BBD
UNC\, xrefs: 00FE9CAB, 00FE9CB0, 00FE9CCD
SeCreateSymbolicLinkPrivilege, xrefs: 00FE9BC7
\??\, xrefs: 00FE9C0B

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CloseFileHandle_wcslen$CreateErrorLast$ControlCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3517300771-3508440684
Opcode ID: fbca5da983251c175b0b54443b57cd568da6cdf78441de053e691c371b916180
Instruction ID: 4992cf90adf54845809f8aea0f2875683a1f425efc5e7d69228a50b8649a4e1b
Opcode Fuzzy Hash: fbca5da983251c175b0b54443b57cd568da6cdf78441de053e691c371b916180
Instruction Fuzzy Hash: 61329F719042C89FDB24DFA5CC81BEE77B8BF15314F104129E949E7281EB78AA48DB61

Function 01001630 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 275windowfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0100163A

Part of subcall function 00FE1E44: GetDlgItem.USER32(00000000,00003021), ref: 00FE1E88
Part of subcall function 00FE1E44: SetWindowTextW.USER32(00000000,0101C6C8), ref: 00FE1E9E

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 010016BB
EndDialog.USER32(?,00000006), ref: 010016CE
GetDlgItem.USER32(?,0000006C), ref: 010016EA
SetFocus.USER32(00000000), ref: 010016F1

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

Part of subcall function 00FE1DE7: SetDlgItemTextW.USER32(?,?,?), ref: 00FE1DFC

SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 01001763
FindFirstFileW.KERNEL32(?,?), ref: 01001783
FindClose.KERNEL32(00000000,?,00000000,00000000,00000000,00000099,?,?,00000000), ref: 01001826
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 010018AD

Part of subcall function 00FE1150: _wcslen.LIBCMT ref: 00FE115B

Strings

%s %s, xrefs: 01001869, 0100199A
REPLACEFILEDLG, xrefs: 0100164F

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Item$MessageSend$FindText_wcslen$CloseDialogFileFirstFocusH_prolog3_Window
String ID: %s %s$REPLACEFILEDLG
API String ID: 485132379-439456425
Opcode ID: ad505d64ea387e66824ba7d8bbec4bfb33bc8074525110784993c58653ca7017
Instruction ID: 4941da95c935e81f45d5e6b5fbee8ef977eeccc645fee8e7743356710cfe9927
Opcode Fuzzy Hash: ad505d64ea387e66824ba7d8bbec4bfb33bc8074525110784993c58653ca7017
Instruction Fuzzy Hash: F7A1A571900258AAEB22EBA5CC46FFEB77DAF05700F0041D5B289B70C1DA799B44DF61

Function 0101480E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 01014954

Strings

1#IND, xrefs: 01015B4C
1#SNAN, xrefs: 01015B53
1#INF, xrefs: 01015B61
1#QNAN, xrefs: 01015B5A

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1c9e4aded73917c78ad5a86820cc09c3bf3f4e4c31160bdd87247187b3330b6a
Instruction ID: 4f96a9534d87dd45e0308f0ac6d641332be979e858d71306d7d5d5631708a6a0
Opcode Fuzzy Hash: 1c9e4aded73917c78ad5a86820cc09c3bf3f4e4c31160bdd87247187b3330b6a
Instruction Fuzzy Hash: 73C25A72E046298FDB65CE28DD407E9B7F5FB85304F1541EAD88DEB244E778AA818F40

Function 00FE3D9D Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00FE438C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FE4523

Strings

CMT, xrefs: 00FE4551

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 2172594012-2756464174
Opcode ID: 4eaf6a8c125afcfaf3f0e86614b7ac738e34ed8bd4e7d120787d39775172b4ca
Instruction ID: d50a2b1d4e5c427ff73c7202772cc4945369c033fc15b7e7c7f8582b784e8def
Opcode Fuzzy Hash: 4eaf6a8c125afcfaf3f0e86614b7ac738e34ed8bd4e7d120787d39775172b4ca
Instruction Fuzzy Hash: 4D721371A003848FCB18DF69C8957EA7BB1FF59310F08453DED5A9B282DB74A944EB60

Function 01006878 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 01006884
IsDebuggerPresent.KERNEL32 ref: 01006950
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 01006970
UnhandledExceptionFilter.KERNEL32(?), ref: 0100697A

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 161f363aaa4f515aa8ddb131fa7221b9a8ddec4af3a21ceab44a9f807ea1585c
Instruction ID: 18c8c6198309192cf02c2455473c689c7b94e125ff6d700165b50a60e1ecc491
Opcode Fuzzy Hash: 161f363aaa4f515aa8ddb131fa7221b9a8ddec4af3a21ceab44a9f807ea1585c
Instruction Fuzzy Hash: 1D312975D452199BEB21DFA4D9897CCBBF8BF08300F1041EAE44DAB290EB759A848F44

Function 00FE932C Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FE952D,?,00000040,00FE931E,00000001,?,?,?,?,0000001C,00FF7618,0102E0C8,WaitForMultipleObjects error %d, GetLastError %d,000000FF), ref: 00FE9330
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,00000000,00000000,00000000,?,?,00FE952D,?,00000040,00FE931E,00000001,?,?), ref: 00FE9351
_wcslen.LIBCMT ref: 00FE9360
LocalFree.KERNEL32(00000000,00000000,00000000,0102E0C8,?,?,00FE952D,?,00000040,00FE931E,00000001,?,?,?,?,0000001C), ref: 00FE9373

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage_wcslen
String ID:
API String ID: 991192900-0
Opcode ID: a4c6348d735c0d557dd731fd1ae02edee3639ed524bd5813c8fd687bfd3db013
Instruction ID: 4393e4fcb45b1f70fdf8e55a09a5414d2fb71790d0e9c93a56c62672efd7de5a
Opcode Fuzzy Hash: a4c6348d735c0d557dd731fd1ae02edee3639ed524bd5813c8fd687bfd3db013
Instruction Fuzzy Hash: BBF082B5645204BFEB159BA29E05EFF776CAB85780B108019F502A6180CAB9DE01A774

Function 01004E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,01004D59,0000001C,01004F4E,00000000,?,?,?,?,?,?,?,01004D59,00000004,01035D84,01004FDE), ref: 01004E25
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,01004D59,00000004,01035D84,01004FDE), ref: 01004E40

Strings

D, xrefs: 01004E34

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 33085d97cacacdfeeb7bab289bb4e24d4dfaf0b4faa2bd0bd073bdf7f3814ca8
Instruction ID: ccdf8f66540c7b5a911c28d8ba940a60f93d6e3d786f6fb9f22aed8ade9176f8
Opcode Fuzzy Hash: 33085d97cacacdfeeb7bab289bb4e24d4dfaf0b4faa2bd0bd073bdf7f3814ca8
Instruction Fuzzy Hash: 1401F7326441096BEB24DE29CC05BEE7BE9AFC4328F0CC165EE99DB284D738DD018680

Function 0100AAC4 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0100535E), ref: 0100ABBC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0100535E), ref: 0100ABC6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0100535E), ref: 0100ABD3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c343bc359e43130ca2a610ef0a67d94a4532095837443737a14a6ef196863097
Instruction ID: 22fb2aa6292b76aff24e83a18fa38de0bc9375543bf528771d0e226a45aa3e83
Opcode Fuzzy Hash: c343bc359e43130ca2a610ef0a67d94a4532095837443737a14a6ef196863097
Instruction Fuzzy Hash: D631D6749412199BDB22DF68DD887DDBBB4BF08310F5041EAE45CA7291E7349B818F44

Function 01011FF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0101218B

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 5d9cdd331a4e8456eb4b44fa59189c39b61dddd2276be689e715b09823281b89
Instruction ID: e63de8c55ea04f9ce36c29941baa0ae54e7a54ea5efb14cb94a78f421c2a69ca
Opcode Fuzzy Hash: 5d9cdd331a4e8456eb4b44fa59189c39b61dddd2276be689e715b09823281b89
Instruction Fuzzy Hash: ED310772900249AFDB26DE7CCC84EFB7BBEDB85304F140298F99887256E6399941CB50

Function 01014360 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
Instruction ID: bb43068816a6b388f71afb1b1c6c15cfab3a2d7beaa4451f4d8e5f007c79943c
Opcode Fuzzy Hash: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
Instruction Fuzzy Hash: F1024D71E002199FDF15CFA9C8806ADBBF1FF48324F2582AAD959E7395D734A941CB80

Function 00FFFD34 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00FFFD6A
GetNumberFormatW.KERNEL32(00000400,00000000,?,01029714,?,?), ref: 00FFFDB3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 7f3ac1e64f15e87a85120373ac172cdb88cedccfe4811dfc8e75c219e280d542
Instruction ID: 7b35060cfa9128b395b8f6681e194989f82c3b49263167da1c134cadc8041e41
Opcode Fuzzy Hash: 7f3ac1e64f15e87a85120373ac172cdb88cedccfe4811dfc8e75c219e280d542
Instruction Fuzzy Hash: 34118B35650358ABEB20DF60DC41BEA77FCFF08704F00482AEA45E7290E639A908CB64

Function 00FE48AA Relevance: 2.0, Strings: 1, Instructions: 776COMMON

Download Yara Rule

Strings

CMT, xrefs: 00FE5131

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 02cf725a4c21cd00951fac5643817a04ea65ff720e42240beac3b567813e14fb
Instruction ID: 7aeeb0492489eacb7d588a9a279e1c8e319f513d4c33c7f643ce4e57fe8b44e9
Opcode Fuzzy Hash: 02cf725a4c21cd00951fac5643817a04ea65ff720e42240beac3b567813e14fb
Instruction Fuzzy Hash: 0362D271A006899FDF08DF75C881BED7BA4BF15314F084179ED49DB282DB38AA44DBA1

Function 010186D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,010186CD,?,?,00000008,?,?,0101836D,00000000), ref: 010188FF

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 26f8ee40b000dd9a53a0c3dfbe52c666f9e0f108006277ea942c302fdedc3c7a
Instruction ID: 6f3fbee02a4375841e228653fe1daf9b4c9f77b2f154f67ffdd9677d955950c4
Opcode Fuzzy Hash: 26f8ee40b000dd9a53a0c3dfbe52c666f9e0f108006277ea942c302fdedc3c7a
Instruction Fuzzy Hash: B7B167315106088FE715CF2CC48AB647BE1FB05364F29C699E9D9CF2A5C339DA92CB40

Function 01006694 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 010066AA

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6deabcb60c53253c67b41a78ff8c4db47405a228aec0a2fca42b8f8cc1b1cc1f
Instruction ID: 8c552a8fb0f764881c2d0054dd85881c051e79b484fa3ee592631a1fb3a084b6
Opcode Fuzzy Hash: 6deabcb60c53253c67b41a78ff8c4db47405a228aec0a2fca42b8f8cc1b1cc1f
Instruction Fuzzy Hash: A451CCB19002158FEF26CF58D4857AEBBF5FB48314F2484AAD485EB285E37B9A50CB50

Function 00FF03BE Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00FF03ED

Part of subcall function 00FF0469: __EH_prolog3.LIBCMT ref: 00FF0470
Part of subcall function 00FF0469: CoCreateInstance.COMBASE(0101EAE0,00000000,00000001,0101EA10,?), ref: 00FF048D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CreateH_prolog3InstanceVersion
String ID:
API String ID: 2013271921-0
Opcode ID: a910bda019e88920fc61e478404ac5d2ad22a1b08073c4fce866abc2653992f5
Instruction ID: af3ff67b2315ed90e7fe5cb87e49205b61c453fc5c18363ec5259ff17bc9651e
Opcode Fuzzy Hash: a910bda019e88920fc61e478404ac5d2ad22a1b08073c4fce866abc2653992f5
Instruction Fuzzy Hash: 8AF0813084424C8AEB35DF70E8447F87BA06F11318F144468EB8657253DBBD558EAF11

Function 00FE5AFE Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

gj, xrefs: 00FE5BCE

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: fce8e48351dd05387fd7fc40015406edd9d469ddc1e17438caf42190b966d7b6
Instruction ID: 12aa1ba7ca44d201498a8377f330cdb9dfbeb6e527611449694cd004d89a2556
Opcode Fuzzy Hash: fce8e48351dd05387fd7fc40015406edd9d469ddc1e17438caf42190b966d7b6
Instruction Fuzzy Hash: 52D1F2B2A083458FC354CF29D88065AFBE2BFC9308F59492EE9D8D7301D774A955CB86

Function 01006A0B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00026A20,01006445), ref: 01006A10

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 43c094863c78d811a8faa0b9df7e7d86d7e13c335e095c7053dd5e290f251f25
Instruction ID: a33ea9d46eb4a4f5b2d5dac4238f5225769a585f1d52bbff9cff39dba9a4524f
Opcode Fuzzy Hash: 43c094863c78d811a8faa0b9df7e7d86d7e13c335e095c7053dd5e290f251f25
Instruction Fuzzy Hash:

Function 01012CE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 01012CE0

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: dd7cc99ba29c7b3c9cc77849b9c6a6ef99ee20be26aceef563d1b62c539c920e
Instruction ID: f495bf6e4d7a1a1b7d4efc4ab70b52b61685d7e65de32d808a89e6a7f74e2895
Opcode Fuzzy Hash: dd7cc99ba29c7b3c9cc77849b9c6a6ef99ee20be26aceef563d1b62c539c920e
Instruction Fuzzy Hash: 16A001706822419FAB618F75A70920E3AA9BA466917898069A486CA258EA2FC5509B11

Function 00FFABC8 Relevance: 1.0, Instructions: 977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
Instruction ID: 887879bb59d31b5cc13c434f62bfdac28c708975a5f697814a717fd9d26b99df
Opcode Fuzzy Hash: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
Instruction Fuzzy Hash: 4782497560478D8FCB29CF28C8D06BABBE1AF91304F18845DD99B8B362D734E945EB11

Function 00FE5F39 Relevance: .9, Instructions: 899COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cdcbdaadd2e83a7aa4a8b2ed91b087576ad96831a2b4cafe54ec7ba9e3081f
Instruction ID: 3e5b7984d1a20d4b2203e82d6aaf4aee9fc2197b80c3bf6c888f4e580bfd9669
Opcode Fuzzy Hash: f2cdcbdaadd2e83a7aa4a8b2ed91b087576ad96831a2b4cafe54ec7ba9e3081f
Instruction Fuzzy Hash: A9825D65D39F899EE3139A3484021E7E3A86EF71C9F46D71FF8A431826E721A6C75301

Function 00FFC27F Relevance: .9, Instructions: 880COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
Instruction ID: 50f0b5663e7c46fce1c814b8555ca8969b6a8627421885a6dd30d49d780d4ebb
Opcode Fuzzy Hash: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
Instruction Fuzzy Hash: CD72483160439D8FCB15CF68CA906B9BBE1FF85300F18856DDA9A8B356D334E845EB91

Function 00FF5214 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
Instruction ID: 7c17675e7b2561a2bab170cf336772c8614469455ae53492908c822461a2ef55
Opcode Fuzzy Hash: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
Instruction Fuzzy Hash: 4A524B72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00FFBC05 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d278cc4681ebade1eaeb0f57958fdf40e699e1f1e6c00a31abd6e6375c8bfde
Instruction ID: b19044029f6817365ef1e2cb0c749706ce2b9288892cb052ccdc25491c39e279
Opcode Fuzzy Hash: 4d278cc4681ebade1eaeb0f57958fdf40e699e1f1e6c00a31abd6e6375c8bfde
Instruction Fuzzy Hash: BF12067160470A8FD728CF28C990BB9B7E0FF44304F10893EE69AC7691D778A995DB41

Function 00FF46CF Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35582c28a5d9d6b9615b5827d55a5a45094123dc8dbce7e3bef640580d370b7
Instruction ID: f399480d55e2bd771fe26099162ba3fd755a1e382c51c1a9a8ea02a4db1eb496
Opcode Fuzzy Hash: c35582c28a5d9d6b9615b5827d55a5a45094123dc8dbce7e3bef640580d370b7
Instruction Fuzzy Hash: 8FE15BB55083919FC314CF29D48046BBBF4BF99301F46095EF9D49B342C235EA2ADB62

Function 00FFA222 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc35cef137013cf0c0e074a9a1304f99eb28e12493afc7fd814db9fd4aed0411
Instruction ID: 248aa0d968155640e569812bc07c6a835b868cdf67eb012a4c9e6caa9a4989f2
Opcode Fuzzy Hash: fc35cef137013cf0c0e074a9a1304f99eb28e12493afc7fd814db9fd4aed0411
Instruction Fuzzy Hash: AD9157B17083494FD725DF28C8807BE77D1AF90314F14093CEA8E8B2A2D6799885A753

Function 0100C0D6 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7546bb178cff1c9a6170fd3d765898e5808515b3784bd7f830d27cc5ae7233
Instruction ID: e671a496aa3a8221e3fee50c9352b00b0940649cb680522af559500324279b34
Opcode Fuzzy Hash: 8c7546bb178cff1c9a6170fd3d765898e5808515b3784bd7f830d27cc5ae7233
Instruction Fuzzy Hash: 7C618A3160060962FEBB9AAC8BA07FE37D4DF57204F5007DAEAC7DB6C0D6119A428355

Function 0100BEA7 Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: 65ce78be82c27c5a7759ce70bf0a8d96d57f1ef8b42c22a8529408360cc8c32f
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: 4B51A829200B8A57FFB7892C86547FF3BD59B12240F0807EEEAC2C76D2C616D945C712

Function 00FF4D32 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce187c5fee8e728483b94032bbbe3c1882bbde169db3b57abf0aac2317aebe0
Instruction ID: 247e8178ef57970d89417fc9d397dfadd3b4ddf8ec4987a90f2ac9fb9a064ec0
Opcode Fuzzy Hash: bce187c5fee8e728483b94032bbbe3c1882bbde169db3b57abf0aac2317aebe0
Instruction Fuzzy Hash: B75129319083D94FC711DF28C4849BFBFE0AF9A318F094999E2D59B152D234E74ADB52

Function 00FF5F0B Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bcf413dcd259df6bdcd33bc042ab5e0d0ea56f46d6473dbe8e302626c1355e
Instruction ID: 123feeb999e74a8b09ee0534e390b313414ac96fec0928557c9436a31ba4eea2
Opcode Fuzzy Hash: 99bcf413dcd259df6bdcd33bc042ab5e0d0ea56f46d6473dbe8e302626c1355e
Instruction Fuzzy Hash: B751EEB1A087119FC758CF29D48055AF7E1FF88314F058A2EE999E7340DB30EA59CB96

Function 00FFA008 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
Instruction ID: 811d5bfa21d5bbfede8c0c547ec94ef0d03eab653abbcc716489b0b3b190917f
Opcode Fuzzy Hash: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
Instruction Fuzzy Hash: F93101B1A0470A8FCB14DF28C85126ABBE0FF95310F104A3DE59AD7352C779E809DB92

Function 00FE7CBA Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
Instruction ID: 65e81a2049aedf4fdba4790f6b8824706b93e32928aeb5a0ea386fd6a4ef7fa4
Opcode Fuzzy Hash: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
Instruction Fuzzy Hash: CC410A30505B15CFC71AEF34D4959A6B7E4FF8A700B1248AFD16A8B231EB30E604EB59

Function 010092D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 9dbc9e04f109403f0c7ec75f42b3e03f76b10e5c24a37749887b10de02a836fb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F5113BB720404143F297862ED4B45BBEBD5EAC522CF2CE2F5D2DA4B6DAD222D1419D00

Function 00FF3EAA Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FF3EEA

Part of subcall function 00FEF6BA: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FEF6CD

Part of subcall function 00FF89ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,0102E088,?,00000007,00FF33E2,?,?,00000050,3ACC59D7), ref: 00FF8A0A

_strlen.LIBCMT ref: 00FF3F0B
SetDlgItemTextW.USER32(?,0102919C,?), ref: 00FF3F64
GetWindowRect.USER32(?,?), ref: 00FF3F9A
GetClientRect.USER32(?,?), ref: 00FF3FA6
GetWindowLongW.USER32(?,000000F0), ref: 00FF4051
GetWindowRect.USER32(?,?), ref: 00FF4081
SetWindowTextW.USER32(?,?), ref: 00FF40B0
GetSystemMetrics.USER32(00000008), ref: 00FF40B8
GetWindow.USER32(?,00000005), ref: 00FF40C3
GetWindowRect.USER32(00000000,?), ref: 00FF40F3
GetWindow.USER32(00000000,00000002), ref: 00FF4165

Strings

CAPTION, xrefs: 00FF4098
d, xrefs: 00FF3FC6
$%s:, xrefs: 00FF3ED3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 3de73a9e4d840738f1b66c5a9b1c87c7aaf0f3b9174ed77344c0fbbd113bc5fd
Instruction ID: e0adcc8c578f1983792ade4d6f0b35a0d5e292e7ab56558ee481e18ee150aada
Opcode Fuzzy Hash: 3de73a9e4d840738f1b66c5a9b1c87c7aaf0f3b9174ed77344c0fbbd113bc5fd
Instruction Fuzzy Hash: 88818AB2508305AFD724DF68CD89A6FBBE9EF88714F00091DFA8593290D775E909CB52

Function 010061A7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(010360E0,00000FA0,?,?,01006185), ref: 010061B3
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,01006185), ref: 010061BE
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,01006185), ref: 010061CF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 010061E1
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 010061EF
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,01006185), ref: 01006212
DeleteCriticalSection.KERNEL32(010360E0,00000007,?,?,01006185), ref: 01006235
CloseHandle.KERNEL32(00000000,?,?,01006185), ref: 01006245

Strings

kernel32.dll, xrefs: 010061CA
api-ms-win-core-synch-l1-2-0.dll, xrefs: 010061B9
WakeAllConditionVariable, xrefs: 010061E7
SleepConditionVariableCS, xrefs: 010061DB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: b766257d26e48d93907803ed17414d2c352a6abdfc277e30918f00ddbdfdeecd
Instruction ID: 28a7664a771c722c4e51f8f011eaba41656b1f3b973d3e0b264107ed65c73c5f
Opcode Fuzzy Hash: b766257d26e48d93907803ed17414d2c352a6abdfc277e30918f00ddbdfdeecd
Instruction Fuzzy Hash: 8E01F530680B12BBF6331BB6AD0EF5B7AADAB46701B004414FDC9D6249DA7FC4108B30

Function 010137D2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 01013816

Part of subcall function 010133B1: _free.LIBCMT ref: 010133CE
Part of subcall function 010133B1: _free.LIBCMT ref: 010133E0
Part of subcall function 010133B1: _free.LIBCMT ref: 010133F2
Part of subcall function 010133B1: _free.LIBCMT ref: 01013404
Part of subcall function 010133B1: _free.LIBCMT ref: 01013416
Part of subcall function 010133B1: _free.LIBCMT ref: 01013428
Part of subcall function 010133B1: _free.LIBCMT ref: 0101343A
Part of subcall function 010133B1: _free.LIBCMT ref: 0101344C
Part of subcall function 010133B1: _free.LIBCMT ref: 0101345E
Part of subcall function 010133B1: _free.LIBCMT ref: 01013470
Part of subcall function 010133B1: _free.LIBCMT ref: 01013482
Part of subcall function 010133B1: _free.LIBCMT ref: 01013494
Part of subcall function 010133B1: _free.LIBCMT ref: 010134A6

_free.LIBCMT ref: 0101380B

Part of subcall function 010103D4: RtlFreeHeap.NTDLL(00000000,00000000,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?), ref: 010103EA
Part of subcall function 010103D4: GetLastError.KERNEL32(?,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?,?), ref: 010103FC

_free.LIBCMT ref: 0101382D
_free.LIBCMT ref: 01013842
_free.LIBCMT ref: 0101384D
_free.LIBCMT ref: 0101386F
_free.LIBCMT ref: 01013882
_free.LIBCMT ref: 01013890
_free.LIBCMT ref: 0101389B
_free.LIBCMT ref: 010138D3
_free.LIBCMT ref: 010138DA
_free.LIBCMT ref: 010138F7
_free.LIBCMT ref: 0101390F

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: dc448d018a8d883115182ea995d9ccc98afbf4534b675d147989f81f9cad1bbc
Instruction ID: 976fb5122fa0d755b0c2782e7aa48e1ea7675d0246bfb2f9fbf54d295f47a3d1
Opcode Fuzzy Hash: dc448d018a8d883115182ea995d9ccc98afbf4534b675d147989f81f9cad1bbc
Instruction Fuzzy Hash: FE317E316043069FEB61AB7DD844BDBB7E9FF00220F548469E9D8EB158DE79E884CB10

Function 00FFD912 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FFD919

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

_wcslen.LIBCMT ref: 00FFD97B
_wcslen.LIBCMT ref: 00FFD99A
_wcslen.LIBCMT ref: 00FFD9B6
_strlen.LIBCMT ref: 00FFDA14
GlobalAlloc.KERNEL32(00000040,?,00000000,0101D9F0,00000000,?,00000000,?,<html>,00000006,<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>,?), ref: 00FFDA2D
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00FFDA54

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00FFD976, 00FFD982
<html>, xrefs: 00FFD95F
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00FFD937
</html>, xrefs: 00FFD9B0, 00FFD9B5, 00FFD9BD

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _wcslen$Global$AllocCreateH_prolog3_Stream_strlen
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 1185167184-1533471033
Opcode ID: 299dfd9df376bbfbb0c67f5c91773bc3705875d974dfec3c71a3b7ada32cdbce
Instruction ID: 20a14095962c63903c73800f99116d2f7e029c8df6b651a891ff36a080f829b5
Opcode Fuzzy Hash: 299dfd9df376bbfbb0c67f5c91773bc3705875d974dfec3c71a3b7ada32cdbce
Instruction Fuzzy Hash: 27519971E0021CAFEB15EBE0CC85BFEBBBAAF15310F140019E645AB195DB785E45DBA0

Function 01003796 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 010037C4
GetClassNameW.USER32(00000000,?,00000080), ref: 010037F0

Part of subcall function 00FF8DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00FF0E3F,?,?,?,00000046,00FF1ECE,00000046,?,exe,00000046), ref: 00FF8DBA

GetWindowLongW.USER32(00000000,000000F0), ref: 0100380C
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 01003823
GetObjectW.GDI32(00000000,00000018,?), ref: 01003837
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 01003860
DeleteObject.GDI32(00000000), ref: 01003867
GetWindow.USER32(00000000,00000002), ref: 01003870

Strings

STATIC, xrefs: 010037F6

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 51c756382f88b8f1ad58079b183147f8c38c3d831e61225b963c1767761180b7
Instruction ID: 85843f1a98beb2685170e7b928c7322ca6b9c445e4d234954d687908047cb5eb
Opcode Fuzzy Hash: 51c756382f88b8f1ad58079b183147f8c38c3d831e61225b963c1767761180b7
Instruction Fuzzy Hash: 3A21F5B2640314BFF233AB289C4AFEF76DCBF45710F000555FB81AA1D6DB29890597A5

Function 0100FF11 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0100FF25

Part of subcall function 010103D4: RtlFreeHeap.NTDLL(00000000,00000000,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?), ref: 010103EA
Part of subcall function 010103D4: GetLastError.KERNEL32(?,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?,?), ref: 010103FC

_free.LIBCMT ref: 0100FF31
_free.LIBCMT ref: 0100FF3C
_free.LIBCMT ref: 0100FF47
_free.LIBCMT ref: 0100FF52
_free.LIBCMT ref: 0100FF5D
_free.LIBCMT ref: 0100FF68
_free.LIBCMT ref: 0100FF73
_free.LIBCMT ref: 0100FF7E
_free.LIBCMT ref: 0100FF8C

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 92b9fd355f02b738f699811e74215da2149e9b1f73540d0b6506923c7d22f6f6
Instruction ID: f3443d263df0a935131603e34321c622df2e77e824bd9780964387a6c71c1d78
Opcode Fuzzy Hash: 92b9fd355f02b738f699811e74215da2149e9b1f73540d0b6506923c7d22f6f6
Instruction Fuzzy Hash: D111C57610414DBFCF41EF94C840CDE3BA9EF18250F9180A5FA889F269DA75EE90DB80

Function 01009AB1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 01009BD0
___TypeMatch.LIBVCRUNTIME ref: 01009CDE
_UnwindNestedFrames.LIBCMT ref: 01009E30
CallUnexpected.LIBVCRUNTIME ref: 01009E4B
_abort.LIBCMT ref: 01009E50

Strings

csm, xrefs: 01009C07
csm, xrefs: 01009B5B
csm, xrefs: 01009AEE

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: a431452052015e94c06d1566b0fb36ea609cdf682f64831b79299535a6f57981
Instruction ID: de294c8feb3366285aafd1dca79e0fe4ab49fbd54155beca59eed9809782912b
Opcode Fuzzy Hash: a431452052015e94c06d1566b0fb36ea609cdf682f64831b79299535a6f57981
Instruction Fuzzy Hash: 33B18F35800609DFEF17EF98C9809AEBBB5FF14318F14409AE9896B292D731DA51CB91

Function 00FED990 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FED99A
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00FED9BF
GetLongPathNameW.KERNEL32(?,?,?), ref: 00FEDA11
GetShortPathNameW.KERNEL32(?,00000000,00000000), ref: 00FEDA34
GetShortPathNameW.KERNEL32(?,?,?), ref: 00FEDA84
MoveFileW.KERNEL32(-00000040,-00000028), ref: 00FEDC9F
MoveFileW.KERNEL32(-00000028,-00000040), ref: 00FEDCEC

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

Strings

rtmp, xrefs: 00FEDBB8

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: NamePath$FileLongMoveShort$H_prolog3__wcslen
String ID: rtmp
API String ID: 2388273531-870060881
Opcode ID: 868663b755df10fc24bfc7fd8c30240025bb2891ae3e404141591d8176259611
Instruction ID: ea84174e75a89529cf3ef37754ee43d077312bd388c8ac52818d1ca9effc1749
Opcode Fuzzy Hash: 868663b755df10fc24bfc7fd8c30240025bb2891ae3e404141591d8176259611
Instruction Fuzzy Hash: 51B15C70D01298DACF21DFA6CC45BEDBBB9BF55304F1400A9E449A7251DB389B89EF60

Function 00FF1E54 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FF1E5B
_wcslen.LIBCMT ref: 00FF1E87

Strings

.rar, xrefs: 00FF1E81, 00FF1E86, 00FF1E8E
sfx, xrefs: 00FF1ED2
rar, xrefs: 00FF1F2E, 00FF1FC9, 00FF1FCE, 00FF1FD6
exe, xrefs: 00FF1EAB

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3__wcslen
String ID: .rar$exe$rar$sfx
API String ID: 3251556500-630704357
Opcode ID: 5d64808d3d5824fd203f08b9625e73504e8b88e9f344ab3331944f436fc24733
Instruction ID: 7493fca5762a589e719c7b0f717910959731aff5a301a38b3d4ca6b53bc7d892
Opcode Fuzzy Hash: 5d64808d3d5824fd203f08b9625e73504e8b88e9f344ab3331944f436fc24733
Instruction Fuzzy Hash: 7671D231E00318DBDB21DFA9C981ABEB7B4BF58B20F200519F6819B2E1DB759942E754

Function 00FF0469 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 197comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF0470
CoCreateInstance.COMBASE(0101EAE0,00000000,00000001,0101EA10,?), ref: 00FF048D

Part of subcall function 00FF0360: __EH_prolog3.LIBCMT ref: 00FF0367

VariantClear.OLEAUT32(?), ref: 00FF05FA

Strings

Windows 10, xrefs: 00FF05E2
Name, xrefs: 00FF05D3
WQL, xrefs: 00FF051E
ROOT\CIMV2, xrefs: 00FF049B
SELECT * FROM Win32_OperatingSystem, xrefs: 00FF050C

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3$ClearCreateInstanceVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3780706886-3505469590
Opcode ID: 25d37f62cf53630c12709fd7b398697f817c5b9b45d37496c805e64eedfba920
Instruction ID: caf6be2cd0216212e7f67f37b87d3f97709413b48e7b9da83c9725bc3aaf0818
Opcode Fuzzy Hash: 25d37f62cf53630c12709fd7b398697f817c5b9b45d37496c805e64eedfba920
Instruction Fuzzy Hash: 43612B71A4021DAFEB14DFA4CC94ABEB7B9FF48710B14015CE646E72A1CB79AD01DB60

Function 010053D0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00FF04AB,00FF04AD,00000000,00000000,3ACC59D7,00000001,00000000,00000000,?,00FF038C,?,00000004,00FF04AB,ROOT\CIMV2), ref: 01005459
MultiByteToWideChar.KERNEL32(00000000,00000000,00FF04AB,?,00000000,00000000,?,?,00FF038C,?,00000004,00FF04AB), ref: 010054D4
SysAllocString.OLEAUT32(00000000), ref: 010054DF
_com_issue_error.COMSUPP ref: 01005508
_com_issue_error.COMSUPP ref: 01005512
GetLastError.KERNEL32(80070057,3ACC59D7,00000001,00000000,00000000,?,00FF038C,?,00000004,00FF04AB,ROOT\CIMV2), ref: 01005517
_com_issue_error.COMSUPP ref: 0100552A
GetLastError.KERNEL32(00000000,?,00FF038C,?,00000004,00FF04AB,ROOT\CIMV2), ref: 01005540
_com_issue_error.COMSUPP ref: 01005553

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 318c0f1aed886a80d3dd33f327f9fba9cdea3f02185935689ceca2052ea08b6d
Instruction ID: d720a1709098fb3569cbf2875daee4d5fb760f5157867f67704e95da777bdb6d
Opcode Fuzzy Hash: 318c0f1aed886a80d3dd33f327f9fba9cdea3f02185935689ceca2052ea08b6d
Instruction Fuzzy Hash: 5641E871A002059BFB169FA8DC44BEEBBF9EB48615F104269F589D72C0DB36D5008FA4

Function 00FFE07E Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FFE085
_wcslen.LIBCMT ref: 00FFE1B7

Strings

<style>, xrefs: 00FFE1C8
<br>, xrefs: 00FFE199
</p>, xrefs: 00FFE183
, xrefs: 00FFE1AA, 00FFE1B6, 00FFE1BE
</style>, xrefs: 00FFE1E5

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3_wcslen
String ID: $</p>$</style>$<br>$<style>
API String ID: 3746244732-3393513139
Opcode ID: f7bae3c0ca3230902bcf1a176e5f7fc46a31f9115f37655a49081080fee21a7d
Instruction ID: 018581ef171e3b68a66be53482a08ba0292f1bee22f69dcd0753dc8eef34c78e
Opcode Fuzzy Hash: f7bae3c0ca3230902bcf1a176e5f7fc46a31f9115f37655a49081080fee21a7d
Instruction Fuzzy Hash: 55510835F4031B96DB309A16885177A73A6AF65761F540019FBC1AB2F0EB798D81F390

Function 010006D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE1E44: GetDlgItem.USER32(00000000,00003021), ref: 00FE1E88
Part of subcall function 00FE1E44: SetWindowTextW.USER32(00000000,0101C6C8), ref: 00FE1E9E

EndDialog.USER32(?,00000001), ref: 01000720
SendMessageW.USER32(?,00000080,00000001,00010405), ref: 01000747
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,14050DFC), ref: 01000760
GetDlgItem.USER32(?,00000065), ref: 0100077C
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 01000790
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 010007A6

Strings

LICENSEDLG, xrefs: 010006E4

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: MessageSend$Item$DialogTextWindow
String ID: LICENSEDLG
API String ID: 3077722735-2177901306
Opcode ID: cff3ef5ef8e39ee43c65d174135a4c6ba4700301b51ceea572c7346e3b4ff885
Instruction ID: f0c477e4581145d23bb63a28bd2c0e2cfb7ccabdca15c72ede5a00354ab86adc
Opcode Fuzzy Hash: cff3ef5ef8e39ee43c65d174135a4c6ba4700301b51ceea572c7346e3b4ff885
Instruction Fuzzy Hash: 2E219C72644218BBE2325E2ADD4CFAB3AADFB4A785F010054F6C5A60C8D76E9901DB31

Function 00FF7818 Relevance: 12.1, APIs: 8, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00FF783D

Part of subcall function 00FF067E: GetVersionExW.KERNEL32(?), ref: 00FF06AF

FileTimeToLocalFileTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00FF7860
FileTimeToSystemTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00FF7872
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00FF7883
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FF7893
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FF78A3
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00FF78DE
__aullrem.LIBCMT ref: 00FF7984

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 99db792a218ef25f1689e0c20d273aa65d57100a4eaa304bd338a251a922a523
Instruction ID: 7f5a44af8337a67bca68b2d5e7d5a06d5e6a85eb62e3fd43ed9bd6e03520e762
Opcode Fuzzy Hash: 99db792a218ef25f1689e0c20d273aa65d57100a4eaa304bd338a251a922a523
Instruction Fuzzy Hash: C35136B15483059FD710DF64C88496BFBE9FF88714F00892EF6DA82210E779E558DB52

Function 00FF0E49 Relevance: 10.7, APIs: 7, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FF0E50
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000030), ref: 00FF0E85
GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00FF0EC4
_wcslen.LIBCMT ref: 00FF0ED4
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,00000030), ref: 00FF0F51
GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00FF0F93
_wcslen.LIBCMT ref: 00FF0FA3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FullNamePath$_wcslen$H_prolog3_
String ID:
API String ID: 840513527-0
Opcode ID: b079bb5670dfef116991cd5a294e0dedd975d159dc694de00efd4c5f93c6bcff
Instruction ID: f60b01fbcdadaf9ae264cfd3c79117a59ca2c372aee1c201a88a1ad4aac02182
Opcode Fuzzy Hash: b079bb5670dfef116991cd5a294e0dedd975d159dc694de00efd4c5f93c6bcff
Instruction Fuzzy Hash: DD614771D00248AADB14DFA9DD84EFEBBB9BF89710F14411AF510E72A1DF389940EB60

Function 01016239 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,010169AE,?,00000000,?,00000000,00000000), ref: 0101627B
__fassign.LIBCMT ref: 010162F6
__fassign.LIBCMT ref: 01016311
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 01016337
WriteFile.KERNEL32(?,?,00000000,010169AE,00000000,?,?,?,?,?,?,?,?,?,010169AE,?), ref: 01016356
WriteFile.KERNEL32(?,?,00000001,010169AE,00000000,?,?,?,?,?,?,?,?,?,010169AE,?), ref: 0101638F

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: c1bfa41c130118a551323d65293d1b792b9d420bcb91d540fcf7d269d88c232f
Instruction ID: bfc12da7aa4767f0fcabcdc88905e78456e3b61051ab250ce395d65cc071a09e
Opcode Fuzzy Hash: c1bfa41c130118a551323d65293d1b792b9d420bcb91d540fcf7d269d88c232f
Instruction Fuzzy Hash: BB51D971A00209DFDB10CFE8DC45AEEBBF9EF09310F14815AE696E7285D7769940CB50

Function 010093C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 010093F7
___except_validate_context_record.LIBVCRUNTIME ref: 010093FF
_ValidateLocalCookies.LIBCMT ref: 01009488
__IsNonwritableInCurrentImage.LIBCMT ref: 010094B3
_ValidateLocalCookies.LIBCMT ref: 01009508

Strings

csm, xrefs: 0100949D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9387698b01e83ef796bc6b73207b5aa2aedfec0640e100344934b501bc5c9f6a
Instruction ID: e1c7522ff9a88e3755dcc7d68238a97c56a0befd807134d31c6374e17f52e380
Opcode Fuzzy Hash: 9387698b01e83ef796bc6b73207b5aa2aedfec0640e100344934b501bc5c9f6a
Instruction Fuzzy Hash: A041C534A002099BEF12DF68C884ADEBBF5BF45318F058195E95D5B3D2CB359A05CB91

Function 00FFE265 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FFE26C
ShowWindow.USER32(?,00000000,00000038), ref: 00FFE294
GetWindowRect.USER32(?,?), ref: 00FFE2D8
ShowWindow.USER32(?,00000005,?,00000000), ref: 00FFE373
ShowWindow.USER32(00000000,00000005), ref: 00FFE394

Strings

RarHtmlClassName, xrefs: 00FFE334

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Window$Show$H_prolog3_Rect
String ID: RarHtmlClassName
API String ID: 950582801-1658105358
Opcode ID: 637d51688fa2b292f86e96a36f35ef230ed08ec2af99f2d90039a81f92e00509
Instruction ID: 0414e9d465f357584e91bcaafaca161325a6185d52d051d48ee4b76817314981
Opcode Fuzzy Hash: 637d51688fa2b292f86e96a36f35ef230ed08ec2af99f2d90039a81f92e00509
Instruction Fuzzy Hash: EB416FB2900208EFDF219FA8DC88BAE7FB9FF48710F144055FA44AB165DB759941EB60

Function 01013554 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01013518: _free.LIBCMT ref: 01013541

_free.LIBCMT ref: 010135A2

Part of subcall function 010103D4: RtlFreeHeap.NTDLL(00000000,00000000,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?), ref: 010103EA
Part of subcall function 010103D4: GetLastError.KERNEL32(?,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?,?), ref: 010103FC

_free.LIBCMT ref: 010135AD
_free.LIBCMT ref: 010135B8
_free.LIBCMT ref: 0101360C
_free.LIBCMT ref: 01013617
_free.LIBCMT ref: 01013622
_free.LIBCMT ref: 0101362D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
Instruction ID: a3380ccb1408c7a486bb9a57ff18bf0b7c91e7daaf44f969a3539930bed05243
Opcode Fuzzy Hash: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
Instruction Fuzzy Hash: BA110D71940B05BBDA30BBB0CC45FCB7B9CBF24B10F808C15B2D9AA199DABDB5458790

Function 01004D5F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,01004DDA,01004D3D,01004FDE), ref: 01004D76
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 01004D8C
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 01004DA1

Strings

AcquireSRWLockExclusive, xrefs: 01004D86
KERNEL32.DLL, xrefs: 01004D71
ReleaseSRWLockExclusive, xrefs: 01004D96

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 1da62c1803b634f8f7420f7ae431180ae646a3e02e2c08644bac779c09a03dcd
Instruction ID: a28876fc6fe7f9b3b0e45646aea889d040b06cad2193c78715c0bc3fff235f91
Opcode Fuzzy Hash: 1da62c1803b634f8f7420f7ae431180ae646a3e02e2c08644bac779c09a03dcd
Instruction Fuzzy Hash: 3AF0FC31B41613A73BB37D79AC8877A26DCAB05619B0001BFEBC5D62C4E629C8118794

Function 01011609 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0100C5A2,0100C5A2,?,?,?,0101185A,00000001,00000001,C5E85006), ref: 01011663
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0101185A,00000001,00000001,C5E85006,?,?,?), ref: 010116E9
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 010117E3
__freea.LIBCMT ref: 010117F0

Part of subcall function 0101040E: RtlAllocateHeap.NTDLL(00000000,0100535E,?,?,01006C16,?,?,?,?,?,01005269,0100535E,?,?,?,?), ref: 01010440

__freea.LIBCMT ref: 010117F9
__freea.LIBCMT ref: 0101181E

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: dec351d84a08769d23f17a50d5496103c03312cb908d4aa64713767c5da3bcd1
Instruction ID: 50b7ed60d4a973219147196a8dff4a1f73890496b948a3ce0ad66bc9c2d2e99b
Opcode Fuzzy Hash: dec351d84a08769d23f17a50d5496103c03312cb908d4aa64713767c5da3bcd1
Instruction Fuzzy Hash: CB51B872600217AFEB294E74CC40EFF7BEAFB44650F154668FE94D6188DB39DC518650

Function 00FF7AA3 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?), ref: 00FF7B06

Part of subcall function 00FF067E: GetVersionExW.KERNEL32(?), ref: 00FF06AF

LocalFileTimeToFileTime.KERNEL32(?,?,?,?), ref: 00FF7B2A
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00FF7B44
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?,?,?), ref: 00FF7B57
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00FF7B67
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00FF7B77

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 8721163c2d38fa924f3241adf68a36b1cd94a3781aac89da6394fd0ea31a0ce5
Instruction ID: 648365fca25de4387ca19c258c30b935d1b928790691939e5813a3c4ebfab8e9
Opcode Fuzzy Hash: 8721163c2d38fa924f3241adf68a36b1cd94a3781aac89da6394fd0ea31a0ce5
Instruction Fuzzy Hash: A64147761083059BC704DFA8C8849ABB7E8FF99714F04491EFA89C7210E734D948CBA6

Function 00FFF33B Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,3ACC59D7,?,?,?,?,0101AA27,000000FF), ref: 00FFF38A
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,?,0101AA27,000000FF), ref: 00FFF399
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,0101AA27,000000FF), ref: 00FFF3A7
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,0101AA27,000000FF), ref: 00FFF3B5
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,?,0101AA27,000000FF), ref: 00FFF3D0
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032,?,?,?,?,0101AA27,000000FF), ref: 00FFF3FA

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific
String ID:
API String ID: 909090443-0
Opcode ID: b4e44f6866055016ad371ab29a58af0070de4bd79583406a696ce4aa6b01d548
Instruction ID: ead90c592aa7edc3bd24b9d48732f60c095e03cb0d73c06947a8c9ea1ad77859
Opcode Fuzzy Hash: b4e44f6866055016ad371ab29a58af0070de4bd79583406a696ce4aa6b01d548
Instruction Fuzzy Hash: 5931DCB2540189ABEB21DFA5DD45EEF77ACFF59710F00412AF946D6140E778AA04CB60

Function 0100977A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01009771,010096CC,01006A64), ref: 01009788
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 01009796
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 010097AF
SetLastError.KERNEL32(00000000,01009771,010096CC,01006A64), ref: 01009801

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e1641d237eaef0d088b5e17a6b6f18a7af8d4946209f55f212a457fe9edea091
Instruction ID: 61bc555d3a7dc8485827da3c847c8e7672fa5ae5f407cb07eddf3037ae6102ef
Opcode Fuzzy Hash: e1641d237eaef0d088b5e17a6b6f18a7af8d4946209f55f212a457fe9edea091
Instruction Fuzzy Hash: 3001B5372093229EB6772DB86CA469A2B84FB123BDF310329F5E8561D5EF164801D340

Function 01010005 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0100B581,?,0102E088,?,0100AE80,?,0102E088,?,00000007), ref: 01010009
_free.LIBCMT ref: 0101003C
_free.LIBCMT ref: 01010064
SetLastError.KERNEL32(00000000,0102E088,?,00000007), ref: 01010071
SetLastError.KERNEL32(00000000,0102E088,?,00000007), ref: 0101007D
_abort.LIBCMT ref: 01010083

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 28407cca9ad4b85adf1c87facbc4fce9599f384095d714fe9bd95bb0108baa79
Instruction ID: 08a62ba2a728bd41ee6559f1c58ae0f409cfe6f5f82b74bac282fdfd0a5439c5
Opcode Fuzzy Hash: 28407cca9ad4b85adf1c87facbc4fce9599f384095d714fe9bd95bb0108baa79
Instruction Fuzzy Hash: BFF0C83514460267E23736796D09F9F2A69AFD2671F260114F7D8D61CDEF3E88828320

Function 01003FCF Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 01003FDB
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 01003FF5
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 01004006
TranslateMessage.USER32(?), ref: 01004010
DispatchMessageW.USER32(?), ref: 0100401A
WaitForSingleObject.KERNEL32(?,0000000A), ref: 01004025

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 9b0444c911e5361a7431283af14174633b6b3cd998cfa85d16681645ab7b9740
Instruction ID: e5c7762c4d1f004e1e87948b22f94fa3cfd74757a7384d23b6e324f7c5cc1660
Opcode Fuzzy Hash: 9b0444c911e5361a7431283af14174633b6b3cd998cfa85d16681645ab7b9740
Instruction Fuzzy Hash: F3F0FF76A01119BBDB315AA5ED4CEDFBFADEF46791F004411F686E2088E639D141CBE0

Function 00FFDC95 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FFDC9C
_wcslen.LIBCMT ref: 00FFDD61
_wcslen.LIBCMT ref: 00FFDDAC

Strings

<br>, xrefs: 00FFDD5C, 00FFDD68
 , xrefs: 00FFDDA7, 00FFDDB3

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _wcslen$H_prolog3
String ID:  $<br>
API String ID: 1035939448-26742755
Opcode ID: bb150b769cb49a44c70fe4912b2aac5a3528c4afdc983ba1f78f2503796a243c
Instruction ID: c99a6a0e279febfc94278c926fcdf7bc960b4594120e588ba4ef7b91822d0df9
Opcode Fuzzy Hash: bb150b769cb49a44c70fe4912b2aac5a3528c4afdc983ba1f78f2503796a243c
Instruction Fuzzy Hash: F3414A31B002199BDB15AF50D881B3D7333FFA5714F60842AE6029F291EBB59982EBD5

Function 0100EE2A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\p2K.exe,00000104), ref: 0100EE6A
_free.LIBCMT ref: 0100EF35
_free.LIBCMT ref: 0100EF3F

Strings

C:\Users\user\Desktop\p2K.exe, xrefs: 0100EE61, 0100EE68, 0100EE97, 0100EECF
X'q, xrefs: 0100EE70

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\p2K.exe$X'q
API String ID: 2506810119-1614706029
Opcode ID: c1f2acef7602d67cc7d183ec946f362d12f50231eb2415d60dcb6ba989deb8d2
Instruction ID: a2869fd54bfe7df46b10ded208d1e35c6d542041fcbc8df9e512220c1a766bba
Opcode Fuzzy Hash: c1f2acef7602d67cc7d183ec946f362d12f50231eb2415d60dcb6ba989deb8d2
Instruction Fuzzy Hash: 6F31B571A00258BFEB23DF99D8849EFBBFCEB95310F1444AAE584A7244D7758E40CB90

Function 01003EFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 01003F03
SetEnvironmentVariableW.KERNEL32(sfxcmd,?,?,?,?,?,?,00000028), ref: 01003F1B
SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 01003F86

Strings

sfxcmd, xrefs: 01003F16
sfxpar, xrefs: 01003F81

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: EnvironmentVariable$H_prolog3_
String ID: sfxcmd$sfxpar
API String ID: 3605364767-3493335439
Opcode ID: 549beaa932b761b92a205750e62173270ac6c9259a0fb0a98af8834153378944
Instruction ID: 605f71313db517a7f6c642bc9d4dfecc89f5bc09a490ff299a8993763a67c7f8
Opcode Fuzzy Hash: 549beaa932b761b92a205750e62173270ac6c9259a0fb0a98af8834153378944
Instruction Fuzzy Hash: 782115709002089FEB1ADFA8E9849EDBBB9FF09300F10441EF585EB280CB35A944CB64

Function 010007E5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 010007F5
GetObjectW.GDI32(00000000,00000018,?), ref: 0100081A
DeleteObject.GDI32(00000000), ref: 0100084C
DeleteObject.GDI32(00000000), ref: 0100086F

Part of subcall function 00FFEBD3: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,01000845,00000066), ref: 00FFEBE6
Part of subcall function 00FFEBD3: SizeofResource.KERNEL32(00000000,?,?,?,01000845,00000066), ref: 00FFEBFD
Part of subcall function 00FFEBD3: LoadResource.KERNEL32(00000000,?,?,?,01000845,00000066), ref: 00FFEC14
Part of subcall function 00FFEBD3: LockResource.KERNEL32(00000000,?,?,?,01000845,00000066), ref: 00FFEC23
Part of subcall function 00FFEBD3: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,01000845,00000066), ref: 00FFEC3E
Part of subcall function 00FFEBD3: GlobalLock.KERNEL32(00000000), ref: 00FFEC4F
Part of subcall function 00FFEBD3: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00FFEC73
Part of subcall function 00FFEBD3: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00FFECB8
Part of subcall function 00FFEBD3: GlobalUnlock.KERNEL32(00000000), ref: 00FFECD7
Part of subcall function 00FFEBD3: GlobalFree.KERNEL32(00000000), ref: 00FFECDE

Strings

], xrefs: 01000822

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: b1fe34abd961aac39e0b5770d9118dedb0f52ad6d2d165ebcc96d838d1af12e4
Instruction ID: 70b25dfe174baac9dfb727387be183e571de4fc65d294c58698a798397f0aae4
Opcode Fuzzy Hash: b1fe34abd961aac39e0b5770d9118dedb0f52ad6d2d165ebcc96d838d1af12e4
Instruction Fuzzy Hash: D3012B35540209A7F72267689C05B7F7ABDAFC0B91F040064FB80A72E9DF79C90557E0

Function 0100ED2F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0100ECE0,00000000,?,0100EC80,00000000,01026F40,0000000C,0100EDD7,00000000,00000002), ref: 0100ED4F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0100ED62
FreeLibrary.KERNEL32(00000000,?,?,?,0100ECE0,00000000,?,0100EC80,00000000,01026F40,0000000C,0100EDD7,00000000,00000002), ref: 0100ED85

Strings

mscoree.dll, xrefs: 0100ED48
CorExitProcess, xrefs: 0100ED5A

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: af6714742db6a5f5a3ba91a144f12a8ffd139ec126994a29aad92d09aeccfc7e
Instruction ID: 07cd41e9a3a36944d7f4a7bb703135cd87b371bd942668bf64cd8c6a447e4d67
Opcode Fuzzy Hash: af6714742db6a5f5a3ba91a144f12a8ffd139ec126994a29aad92d09aeccfc7e
Instruction Fuzzy Hash: 37F06830950118FBEB22AFB9DD09BEDBFF5EF04715F0001A9F989A6144DB398A45CB50

Function 0100985A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 01009921
___AdjustPointer.LIBCMT ref: 01009944
_abort.LIBCMT ref: 01009992
___AdjustPointer.LIBCMT ref: 010099E0

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: ac88a343b477e6140a8682c46ac2b8b5b06f556a8789b25a1d8f68b41a5e4f77
Instruction ID: a76d29ca1d6c1130541e096418571ac6e910dec98e6368a8582035cb55c8ffb1
Opcode Fuzzy Hash: ac88a343b477e6140a8682c46ac2b8b5b06f556a8789b25a1d8f68b41a5e4f77
Instruction Fuzzy Hash: 9751C372605207AFFB2B8F5CD840BAA77A4EF44308F14456DE9C9472D2E7329984C790

Function 01012BE0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 01012BE9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 01012C0C

Part of subcall function 0101040E: RtlAllocateHeap.NTDLL(00000000,0100535E,?,?,01006C16,?,?,?,?,?,01005269,0100535E,?,?,?,?), ref: 01010440

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 01012C32
_free.LIBCMT ref: 01012C45
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 01012C54

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 269fded26c59d34f9b0d25ab88528477f8a18e52b3d6e193790823c16e579878
Instruction ID: b7b9ef91ff3d55f92d06c796ceae4ae550d7e14e62f418cd91d4f37db10d5d3a
Opcode Fuzzy Hash: 269fded26c59d34f9b0d25ab88528477f8a18e52b3d6e193790823c16e579878
Instruction Fuzzy Hash: 8501D4726412997F333525EA5D8CCBB6EADDFC6A613240168BF84D310CDE6DCC0182B0

Function 01010089 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0100535E,0100535E,?,010101D8,01010451,?,?,01006C16,?,?,?,?,?,01005269,0100535E,?), ref: 0101008E
_free.LIBCMT ref: 010100C3
_free.LIBCMT ref: 010100EA
SetLastError.KERNEL32(00000000,?,0100535E), ref: 010100F7
SetLastError.KERNEL32(00000000,?,0100535E), ref: 01010100

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 8ef0ad525956c57b1bae7730df45b139cf02f5d99224fdad88e4ebd8798404e3
Instruction ID: 74a465f9643b8d0583f8fe9d9d2652a161d41604e6e62353b9a45ea1008e4ce8
Opcode Fuzzy Hash: 8ef0ad525956c57b1bae7730df45b139cf02f5d99224fdad88e4ebd8798404e3
Instruction Fuzzy Hash: 2E01F93214460227A33736785E84AAB256EAFC1271F210128F5C5A318DEF7D88814360

Function 00FF74EC Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00FF77CF: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00000004,00FE73B8), ref: 00FF77E1
Part of subcall function 00FF77CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000004,00FE73B8), ref: 00FF77F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000,3ACC59D7,?,?,00000001,00000000,0101A603,000000FF,?,00FF90B9,?,?,00FE5630,?), ref: 00FF752A
CloseHandle.KERNEL32(?,?,?,00FF90B9,?,?,00FE5630,?,?,?,00000000,?,?,?,00000001,?), ref: 00FF7544
DeleteCriticalSection.KERNEL32(?,?,00FF90B9,?,?,00FE5630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00FF755D
CloseHandle.KERNEL32(?,?,00FF90B9,?,?,00FE5630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00FF7569
CloseHandle.KERNEL32(?,?,00FF90B9,?,?,00FE5630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00FF7575

Part of subcall function 00FF75ED: WaitForSingleObject.KERNEL32(?,000000FF,00FF770A,?,?,00FF777F,?,?,?,?,?,00FF7769), ref: 00FF75F3
Part of subcall function 00FF75ED: GetLastError.KERNEL32(?,?,00FF777F,?,?,?,?,?,00FF7769), ref: 00FF75FF

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: d3c401c440971c58fd099ba2b246cc77d62caa84a7f4a3c78817d6c728c9d71b
Instruction ID: d06ff0f122716e97c7042a235a58a4f9c15021df4719dd975f75ec3142d85430
Opcode Fuzzy Hash: d3c401c440971c58fd099ba2b246cc77d62caa84a7f4a3c78817d6c728c9d71b
Instruction Fuzzy Hash: 0A11C472544744EFD732AF64D984FD6FBA9FF08710F044929F29692150CB7AE940DB50

Function 010134AF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 010134C7

Part of subcall function 010103D4: RtlFreeHeap.NTDLL(00000000,00000000,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?), ref: 010103EA
Part of subcall function 010103D4: GetLastError.KERNEL32(?,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?,?), ref: 010103FC

_free.LIBCMT ref: 010134D9
_free.LIBCMT ref: 010134EB
_free.LIBCMT ref: 010134FD
_free.LIBCMT ref: 0101350F

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e1886eb4277fc4457ac63e83e8e9c3b47c8b4b47f47cad7ae32533087fe3f24e
Instruction ID: 2ffbb62145aead7d3a05c0150ef0bf9343d67ebf7acd3d3d98548dc49d02923c
Opcode Fuzzy Hash: e1886eb4277fc4457ac63e83e8e9c3b47c8b4b47f47cad7ae32533087fe3f24e
Instruction Fuzzy Hash: 4CF0EC32504211A7DA70DA98F485C967BDDBB507247A94845F5C8EB90CCE7DF8808750

Function 0100F7C0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0100F7DE

Part of subcall function 010103D4: RtlFreeHeap.NTDLL(00000000,00000000,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?), ref: 010103EA
Part of subcall function 010103D4: GetLastError.KERNEL32(?,?,01013546,?,00000000,?,00000000,?,0101356D,?,00000007,?,?,0101396A,?,?), ref: 010103FC

_free.LIBCMT ref: 0100F7F0
_free.LIBCMT ref: 0100F803
_free.LIBCMT ref: 0100F814
_free.LIBCMT ref: 0100F825

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55a4c5f61bc6d8893f0c471730d7e400b888fa956da074b5690457aebc2f3324
Instruction ID: f5dbded5cbcedcc7bb07235322385c17baa8de8546f1a45eb626289c71ba29f4
Opcode Fuzzy Hash: 55a4c5f61bc6d8893f0c471730d7e400b888fa956da074b5690457aebc2f3324
Instruction Fuzzy Hash: C6F05E70800221AB9A336F68B8014C97BEDF724724792414AF0D9A225CDF7F1682DB91

Function 01002B26 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000105,00000000,00000000,0000020A), ref: 01002B66

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

Part of subcall function 00FF0BF3: _wcslen.LIBCMT ref: 00FF0C03

EndDialog.USER32(?,00000001), ref: 01002EDA

Strings

@set:user, xrefs: 01002D20
, xrefs: 01002E88

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: _wcslen$DialogPathTemp
String ID: $@set:user
API String ID: 2172748170-1503366402
Opcode ID: 10c02f65d3135f210a97bba8cecb2ab3c26f3f2848890465006d23b071e9e337
Instruction ID: 09af42c2b5d59c9c5de75c998759308096ccb0d4a1bea13571e96bbbd04c7e7e
Opcode Fuzzy Hash: 10c02f65d3135f210a97bba8cecb2ab3c26f3f2848890465006d23b071e9e337
Instruction Fuzzy Hash: 4AC1607080129D9AEF21EBA5CC45BEDBBB8BF15300F1400EAE449B3182DB785B88DF51

Function 00FFEF21 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

Part of subcall function 00FFEBAA: GetDC.USER32(00000000), ref: 00FFEBAE
Part of subcall function 00FFEBAA: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FFEBB9
Part of subcall function 00FFEBAA: ReleaseDC.USER32(00000000,00000000), ref: 00FFEBC4

GetObjectW.GDI32(?,00000018,?), ref: 00FFEF65

Part of subcall function 00FFF1EC: GetDC.USER32(00000000), ref: 00FFF1F5
Part of subcall function 00FFF1EC: GetObjectW.GDI32(?,00000018,?), ref: 00FFF224
Part of subcall function 00FFF1EC: ReleaseDC.USER32(00000000,?), ref: 00FFF2BC

Strings

(, xrefs: 00FFF0BA

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: a64d03e1be212c20f3b2df7c742581d6860625e49873acd51953e030b60d74cb
Instruction ID: e93ec5335bb97e19b59d60cf6f416b23a330078f8a5f5dfaf0ce3919f510ac08
Opcode Fuzzy Hash: a64d03e1be212c20f3b2df7c742581d6860625e49873acd51953e030b60d74cb
Instruction Fuzzy Hash: 6791F2716083149FD720DF65C844A6BBBE9FF89B10F00495EF98AD7260CB39E905DB62

Function 00FEA300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEA307
GetLastError.KERNEL32(00000054,?,?,?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049), ref: 00FEA427

Part of subcall function 00FEAC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00FEAC2E
Part of subcall function 00FEAC11: GetLastError.KERNEL32 ref: 00FEAC72
Part of subcall function 00FEAC11: CloseHandle.KERNEL32(?), ref: 00FEAC81

Strings

SeRestorePrivilege, xrefs: 00FEA356
SeSecurityPrivilege, xrefs: 00FEA341

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorLast$CloseCurrentH_prolog3_HandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2235100918-639343689
Opcode ID: 84742bf8be2ce0560f0558e709d0d37f69dcd61329f76c6c92df64e6ff01486d
Instruction ID: 387a05591e6c1e817d3a4b3d9f01eed49796c6a3ba30c1d35bafdb15439e03d9
Opcode Fuzzy Hash: 84742bf8be2ce0560f0558e709d0d37f69dcd61329f76c6c92df64e6ff01486d
Instruction Fuzzy Hash: 6A41B170D00248AFDF25DFA9E885BEDB7B8AF08314F14401EF545B7281DB79A944EB22

Function 01009E56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 01009E7B
_abort.LIBCMT ref: 01009F86

Strings

MOC, xrefs: 01009E8D
RCC, xrefs: 01009E95

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 83f7f6734863c835fafd50b94cb12b597e6574b9edafba4b5df693e348022179
Instruction ID: 2d080d64cda6be8b8db74c7b5a301a0fb85ab964be0498d3282787b54f6e629e
Opcode Fuzzy Hash: 83f7f6734863c835fafd50b94cb12b597e6574b9edafba4b5df693e348022179
Instruction Fuzzy Hash: 71418E71900209EFEF16DF98CD80AEE7BB5FF48308F188199FA8867292D7359951DB50

Function 00FF338E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00FF340E
_strncpy.LIBCMT ref: 00FF3459

Part of subcall function 00FF89ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,0102E088,?,00000007,00FF33E2,?,?,00000050,3ACC59D7), ref: 00FF8A0A

Strings

$%s, xrefs: 00FF3403
@%s, xrefs: 00FF33F8

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 475632fb66ecb59002bce9c7c683dabd9ab5850e21225734c239fe5f456f978d
Instruction ID: 9a3a3508cd6d5a3c3f4a21851451ec7c449c4dd29429d935c2636dd4ee9e8dce
Opcode Fuzzy Hash: 475632fb66ecb59002bce9c7c683dabd9ab5850e21225734c239fe5f456f978d
Instruction Fuzzy Hash: F7217E7290070DABEB11DEA8CD45EFE7BA8BF04710F040525FA14D72A1DB75EA15DB60

Function 00FFF8F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FFF8F7

Part of subcall function 00FE1E44: GetDlgItem.USER32(00000000,00003021), ref: 00FE1E88
Part of subcall function 00FE1E44: SetWindowTextW.USER32(00000000,0101C6C8), ref: 00FE1E9E

EndDialog.USER32(?,00000001), ref: 00FFF99F
SetDlgItemTextW.USER32(?,00000066,00000000), ref: 00FFF9E1

Strings

ASKNEXTVOL, xrefs: 00FFF909

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ItemText$DialogH_prolog3_Window
String ID: ASKNEXTVOL
API String ID: 2321058237-3402441367
Opcode ID: 846d5089ecf12c8334c2c44fbd7dd51519756401901fba46cd09e1b36d855d48
Instruction ID: 6b4f6124b384a17e5c6eb020e51c95dbc2d3cbeda908056be7124117c8936fa7
Opcode Fuzzy Hash: 846d5089ecf12c8334c2c44fbd7dd51519756401901fba46cd09e1b36d855d48
Instruction Fuzzy Hash: D0218231A40149BFDB35DF64CC45FBD37A8BF06310F104424F681AB1A5D779A908EB21

Function 00FF7445 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00FEFEBD,00000008,00000004,00FF2D42,?,?,?,?,00000000,00FFABB6,?), ref: 00FF7484
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00FEFEBD,00000008,00000004,00FF2D42,?,?,?,?,00000000), ref: 00FF748E
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00FEFEBD,00000008,00000004,00FF2D42,?,?,?,?,00000000), ref: 00FF749E

Strings

Thread pool initialization failed., xrefs: 00FF74B6

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 81a0ad461705837de0c6f16d0d0686407d681b95b4c746b627abf8c87ac9e5c0
Instruction ID: 757b20d3ce26c0ce6228fd23d21a11bec34b9406d2cb326b9e8810bdfc714f14
Opcode Fuzzy Hash: 81a0ad461705837de0c6f16d0d0686407d681b95b4c746b627abf8c87ac9e5c0
Instruction Fuzzy Hash: BD11A3B1648709AFD331AF6A9C849A7FFDCEF59754F10082EF2DAC3200D6B559809B64

Function 0100406A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 010040CB
REPLACEFILEDLG, xrefs: 010040B8, 010040F2

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 918a5af49d67891a4437d7f34349d706147b0696578cfd0cee4c65f856106507
Instruction ID: ddf021a79ff0e7b8d6b67ae3d9374e6e35f568dbd93948f529a4bbccf4f80f59
Opcode Fuzzy Hash: 918a5af49d67891a4437d7f34349d706147b0696578cfd0cee4c65f856106507
Instruction Fuzzy Hash: 2F115275304300AFE332CF59EC449567BE9E749651F044829FBC1E7264C3769854CFA5

Function 0100A892 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0100A843,00000000,?,01036150,?,?,?,0100A9E6,00000004,InitializeCriticalSectionEx,0101F7F4,InitializeCriticalSectionEx), ref: 0100A89F
GetLastError.KERNEL32(?,0100A843,00000000,?,01036150,?,?,?,0100A9E6,00000004,InitializeCriticalSectionEx,0101F7F4,InitializeCriticalSectionEx,00000000,?,0100A79D), ref: 0100A8A9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0100A8D1

Strings

api-ms-, xrefs: 0100A8B6

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d7187f5fe95895c3d80fe6c3316bc3e18d2b27fb5ccfc09d44c3540ab3b3851d
Instruction ID: ff9ae273fa9d23ab2c841319117e9c9c1cca6d3716a9f2b9ddf38bfd0a91c0fb
Opcode Fuzzy Hash: d7187f5fe95895c3d80fe6c3316bc3e18d2b27fb5ccfc09d44c3540ab3b3851d
Instruction Fuzzy Hash: A7E04F303C0305F7FF621AA1ED06B583F99AB10A91F154070FA8DE84D5D7AAD5119B95

Function 010107EA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 01010875
__alldvrm.LIBCMT ref: 01010A76
__alldvrm.LIBCMT ref: 01010A98

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
Instruction ID: c096019102beab4cb29e35bb1c71a7183b546d1f2df5d042acc5876481142ec0
Opcode Fuzzy Hash: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
Instruction Fuzzy Hash: 32A12972A043869FEB12CE6CC8507AEBFE5EF55310F1842A9F5D59B289C67C8981C790

Function 01013638 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,01010481,?,00000000,?,00000001,?,?,00000001,01010481,?), ref: 01013685
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0101370E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0100DBD1,?), ref: 01013720
__freea.LIBCMT ref: 01013729

Part of subcall function 0101040E: RtlAllocateHeap.NTDLL(00000000,0100535E,?,?,01006C16,?,?,?,?,?,01005269,0100535E,?,?,?,?), ref: 01010440

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: bdaea2f70377be5d2ed893d9834fe25efbcb951e8b7df7873532a3068035af96
Instruction ID: 4ab6e9cc9707c040734dc9c61f8f0dc87ef9db2b95890a5b5b55767ff1593a6c
Opcode Fuzzy Hash: bdaea2f70377be5d2ed893d9834fe25efbcb951e8b7df7873532a3068035af96
Instruction Fuzzy Hash: 9F31B371A00206ABEF258F68DC44DEF7BE5FB44260F144168FC84DA294E73AC954CB90

Function 00FF62CD Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF62D4
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000010), ref: 00FF62EB
ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000010), ref: 00FF6328
_wcslen.LIBCMT ref: 00FF6338

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: EnvironmentExpandStrings$H_prolog3_wcslen
String ID:
API String ID: 3741103063-0
Opcode ID: b37f7fdc9e61d62776fc444a52089c918ae4dc34c53bfeb17a646c1cb7611f60
Instruction ID: 67c7e670d4c9f43c5f5fcbe5af3aace9b04f8421f81da5e30590d89adbb3b7fa
Opcode Fuzzy Hash: b37f7fdc9e61d62776fc444a52089c918ae4dc34c53bfeb17a646c1cb7611f60
Instruction Fuzzy Hash: EE119A71A0120EAFAB00DFA99D849BFBB79BF45314B04011DA551E7280DF38AD00EBA0

Function 00FF126C Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF1273

Part of subcall function 00FF067E: GetVersionExW.KERNEL32(?), ref: 00FF06AF

FoldStringW.KERNEL32(00000020,?,000000FF,00000000,00000000,0000000C,00FE350C,3ACC59FF,00000000,?,?,00FE43F5,?,?,?,00000000), ref: 00FF129A
FoldStringW.KERNEL32(00000020,?,000000FF,?,?,00000000), ref: 00FF12D4
_wcslen.LIBCMT ref: 00FF12DF

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FoldString$H_prolog3Version_wcslen
String ID:
API String ID: 535866816-0
Opcode ID: b67f297c161b5c74e78823be751c037ac1a09388a65bd5535d41d975d30e19ad
Instruction ID: 6d468f7d7bc1d5a8635c08069ddc1c468b3b29f44982211ec60e702caf777103
Opcode Fuzzy Hash: b67f297c161b5c74e78823be751c037ac1a09388a65bd5535d41d975d30e19ad
Instruction Fuzzy Hash: D7117371A1112AEBEB119FAACD499BF7B79BF45720F100209BA50E72D0CB749940D7F1

Function 010119E4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0101198B,00000000,00000000,00000000,00000000,?,01011B88,00000006,FlsSetValue), ref: 01011A16
GetLastError.KERNEL32(?,0101198B,00000000,00000000,00000000,00000000,?,01011B88,00000006,FlsSetValue,01020DD0,FlsSetValue,00000000,00000364,?,010100D7), ref: 01011A22
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0101198B,00000000,00000000,00000000,00000000,?,01011B88,00000006,FlsSetValue,01020DD0,FlsSetValue,00000000), ref: 01011A30

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 3fc2169f07b92cb70beb359126edcbfd759c12760ffb0963209edccadd34e5b0
Instruction ID: 703ddfa793eb0faf10357beebe5fca2d25adee58c832765780a8856dfa9bd7de
Opcode Fuzzy Hash: 3fc2169f07b92cb70beb359126edcbfd759c12760ffb0963209edccadd34e5b0
Instruction Fuzzy Hash: 7E014733641222ABD77689BC9C04A563FDCAF057A1B550620FB8AD3248D73DD400C7E0

Function 00FF1309 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF1310
GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00FF17FB,?,?,\\?\,3ACC59D7,?,?,?,00000000,0101A279,000000FF), ref: 00FF1319
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,?,00000000,0101A279,000000FF), ref: 00FF1348
_wcslen.LIBCMT ref: 00FF1351

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CurrentDirectory$H_prolog3_wcslen
String ID:
API String ID: 19219720-0
Opcode ID: 27f489b23a986f3391e7f0c050cd868d0f77be1971d9cb4a62a08436bd6a17cd
Instruction ID: 295f82bb97e8cd109b4b857c093ffddff1b7b9f7d0d380d13f0675728b9f5221
Opcode Fuzzy Hash: 27f489b23a986f3391e7f0c050cd868d0f77be1971d9cb4a62a08436bd6a17cd
Instruction Fuzzy Hash: 9901A771D0011AEB9B11AFB59D149FF7B79BF96720B110209B651E7284CF389900A7E0

Function 0100631E Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,010062BB,00000064), ref: 01006341
LeaveCriticalSection.KERNEL32(010360E0,?,?,010062BB,00000064,?,?,?,?,00000000,0101A75D,000000FF), ref: 0100634B
WaitForSingleObjectEx.KERNEL32(00000064,00000000,?,010062BB,00000064,?,?,?,?,00000000,0101A75D,000000FF), ref: 0100635C
EnterCriticalSection.KERNEL32(010360E0,?,010062BB,00000064,?,?,?,?,00000000,0101A75D,000000FF), ref: 01006363

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: bf38add2cfafa80dba5c8e01ef926e3c03d58c36c9ac6a59d706383b615b45db
Instruction ID: 8f6c68324bc40de1358e05f6f4879b846b271f42bce3cc0c06b0a47c8b8fa708
Opcode Fuzzy Hash: bf38add2cfafa80dba5c8e01ef926e3c03d58c36c9ac6a59d706383b615b45db
Instruction Fuzzy Hash: 71E09231580134FBD7321BD1ED0AB9EBF3DAB45A90F048014F98AA6154C66F9A209BD4

Function 00FFEB74 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FFEB77
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FFEB86
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FFEB94
ReleaseDC.USER32(00000000,00000000), ref: 00FFEBA2

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 004a28930eb616e0b280a7dadcba3b6e05809ba7610f07080b0f5330142415e4
Instruction ID: ef575074714fe24e55768a0dd1a8e2545e319c0b2c51d68575214aa58997b2db
Opcode Fuzzy Hash: 004a28930eb616e0b280a7dadcba3b6e05809ba7610f07080b0f5330142415e4
Instruction Fuzzy Hash: 65E0EC76942B20ABD6311B74BD0DB867A5CAF19B23F000541FB81AA198C6AA4440CB90

Function 00FF7C68 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00FF8294

Part of subcall function 00FE14A7: _wcslen.LIBCMT ref: 00FE14B8

Part of subcall function 0100087E: __EH_prolog3_GS.LIBCMT ref: 01000885
Part of subcall function 0100087E: GetLastError.KERNEL32(0000001C,00FF8244,?,00000000,00000086,?,3ACC59D7,?,?,?,?,?,00000000,0101A75D,000000FF), ref: 0100089D
Part of subcall function 0100087E: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,0101A75D,000000FF), ref: 010008D6

Strings

%ls, xrefs: 00FF7CF7

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorLast$H_prolog3_Init_thread_footer_wcslen
String ID: %ls
API String ID: 1279724102-3246610740
Opcode ID: d51b87f10b121311ee2d21bcb8c24d3ea6c6714ccde87bddfaa27c9f6933c76f
Instruction ID: 10f9b4828aabbd503a5b16b9095da1d0002f70e0f30011853e33f2b9eb1e0df9
Opcode Fuzzy Hash: d51b87f10b121311ee2d21bcb8c24d3ea6c6714ccde87bddfaa27c9f6933c76f
Instruction Fuzzy Hash: 05B1AD31804249EADB30EF51CD46FBEBBA5BF15350F204519F682261E1EB79AB15FA80

Function 01001F82 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF1309: __EH_prolog3.LIBCMT ref: 00FF1310
Part of subcall function 00FF1309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00FF17FB,?,?,\\?\,3ACC59D7,?,?,?,00000000,0101A279,000000FF), ref: 00FF1319

Part of subcall function 00FF1AD1: __EH_prolog3_GS.LIBCMT ref: 00FF1AD8

Part of subcall function 00FEF763: __EH_prolog3_GS.LIBCMT ref: 00FEF76A

Part of subcall function 00FEF58B: __EH_prolog3_GS.LIBCMT ref: 00FEF592
Part of subcall function 00FEF58B: SetFileAttributesW.KERNEL32(?,?,00000024,00FEA724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00FEF5A8
Part of subcall function 00FEF58B: SetFileAttributesW.KERNEL32(?,?,?,?,?,00FED303,?,?,?,?,?,?,?,3ACC59D7,00000049), ref: 00FEF5EB

MoveFileW.KERNEL32(?,?), ref: 010022BE
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 010022D8

Part of subcall function 00FF14CC: __EH_prolog3_GS.LIBCMT ref: 00FF14D3

Strings

.tmp, xrefs: 0100222B

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FileH_prolog3_$AttributesMove$CurrentDirectoryH_prolog3
String ID: .tmp
API String ID: 3107500630-2986845003
Opcode ID: 2ff426f9863778464ea90cbbc0d79842250e31e03a610bc82306eeb5ddbdc57c
Instruction ID: 75fe508acef64fed21097d5718baa83ad9d77201926de325874253ef0817e14d
Opcode Fuzzy Hash: 2ff426f9863778464ea90cbbc0d79842250e31e03a610bc82306eeb5ddbdc57c
Instruction Fuzzy Hash: 18C1D771C002689ADB66DFA5CC84BDDBBB8BF18300F5441EAE549A3251DB385B89DF21

Function 01011E68 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01011FD4

Part of subcall function 0100ACBB: IsProcessorFeaturePresent.KERNEL32(00000017,0100AC8D,0100535E,?,?,00000000,0100535E,00000016,?,?,0100AC9A,00000000,00000000,00000000,00000000,00000000), ref: 0100ACBD
Part of subcall function 0100ACBB: GetCurrentProcess.KERNEL32(C0000417,?,0100535E), ref: 0100ACDF
Part of subcall function 0100ACBB: TerminateProcess.KERNEL32(00000000,?,0100535E), ref: 0100ACE6

Strings

*?, xrefs: 01011EAB
., xrefs: 0101218B

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: ddd9ab5e61b6f17a30a233bd59a6b62b4ed979bfdbd97246aefffea125efcfc1
Instruction ID: 3ad5b04b9be074259b236b8642e780cc9dc1d80f010d0369d2270b3cb565e354
Opcode Fuzzy Hash: ddd9ab5e61b6f17a30a233bd59a6b62b4ed979bfdbd97246aefffea125efcfc1
Instruction Fuzzy Hash: 80519275E0021A9FDF15DFA8C880AEDB7F5EF58310F2541ADE984E7345E7399A018B50

Function 00FEF103 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00FF79F7: GetSystemTime.KERNEL32(?,00000000), ref: 00FF7A0F
Part of subcall function 00FF79F7: SystemTimeToFileTime.KERNEL32(?,?), ref: 00FF7A1D

Part of subcall function 00FF79A0: __aulldiv.LIBCMT ref: 00FF79A9

__aulldiv.LIBCMT ref: 00FEF162
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,3ACC59D7,?,?,00000000,?,00000000,01019F3D,000000FF), ref: 00FEF169

Part of subcall function 00FE1150: _wcslen.LIBCMT ref: 00FE115B

Strings

.rartemp, xrefs: 00FEF1D8

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: Time$System__aulldiv$CurrentFileProcess_wcslen
String ID: .rartemp
API String ID: 3789791499-2558811017
Opcode ID: 2558c641e84eee4bd006b9d0f83c71530853ad6572e69f5d81f2d0663552c435
Instruction ID: c507b04d39ded60b421455a1a96fcba9e60d6f26deaca59f699f99f7eca698d4
Opcode Fuzzy Hash: 2558c641e84eee4bd006b9d0f83c71530853ad6572e69f5d81f2d0663552c435
Instruction Fuzzy Hash: 01417171900289ABDB14EFA6CC45FEEB7A9FF54710F404129F91593281EB7C9B09DB60

Function 00FFDACE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FFDAD5

Part of subcall function 00FF0360: __EH_prolog3.LIBCMT ref: 00FF0367

Strings

about:blank, xrefs: 00FFDBD3
Shell.Explorer, xrefs: 00FFDB11

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: H_prolog3
String ID: Shell.Explorer$about:blank
API String ID: 431132790-874089819
Opcode ID: 0fa7c7dbdbbf374fe574f5511afce6adbd438718a875fac0e6cf317d6b11674e
Instruction ID: 095f2acdc065493b700867437569441a730f81e560aa173fa3c78358973074e2
Opcode Fuzzy Hash: 0fa7c7dbdbbf374fe574f5511afce6adbd438718a875fac0e6cf317d6b11674e
Instruction Fuzzy Hash: BA416071A002098FDB18DF64CC55B7A77B6BF88700F15406DEA469F2A5DB75AC00EB50

Function 01000110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00FE1E44: GetDlgItem.USER32(00000000,00003021), ref: 00FE1E88
Part of subcall function 00FE1E44: SetWindowTextW.USER32(00000000,0101C6C8), ref: 00FE1E9E

EndDialog.USER32(?,00000001), ref: 0100017B
SetDlgItemTextW.USER32(?,00000067,?), ref: 010001B9

Strings

GETPASSWORD1, xrefs: 01000148

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 194f291f0dc9f6a5bd9baf1a81efb03ff0a38d50a85c793ad5e4e752d8b04435
Instruction ID: 1e9bf1518809f9161a63e2ad52333312dffdb549d39a23148ab15437ecd2a917
Opcode Fuzzy Hash: 194f291f0dc9f6a5bd9baf1a81efb03ff0a38d50a85c793ad5e4e752d8b04435
Instruction Fuzzy Hash: 7A11E6B264435877F2729A289C49FFB77ECEB85740F000428F789A71C4C735A9018666

Function 00FE1E44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00FF3EAA: _swprintf.LIBCMT ref: 00FF3EEA
Part of subcall function 00FF3EAA: _strlen.LIBCMT ref: 00FF3F0B
Part of subcall function 00FF3EAA: SetDlgItemTextW.USER32(?,0102919C,?), ref: 00FF3F64
Part of subcall function 00FF3EAA: GetWindowRect.USER32(?,?), ref: 00FF3F9A
Part of subcall function 00FF3EAA: GetClientRect.USER32(?,?), ref: 00FF3FA6

GetDlgItem.USER32(00000000,00003021), ref: 00FE1E88
SetWindowTextW.USER32(00000000,0101C6C8), ref: 00FE1E9E

Strings

0, xrefs: 00FE1E47

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: eee78329ce7bd76fe76d12a3fd5acccdcb7518ad1901c4f57fbbf6c260405deb
Instruction ID: f1386a09787fa19d32eb9930717c69d993d9d04621f3b31ea0846a4a551021c8
Opcode Fuzzy Hash: eee78329ce7bd76fe76d12a3fd5acccdcb7518ad1901c4f57fbbf6c260405deb
Instruction Fuzzy Hash: 13F0AF3194028CA6DF350E63DD0ABFA3B99BF15324F044248FD84541A1C779DA95FB50

Function 00FF75ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00FF770A,?,?,00FF777F,?,?,?,?,?,00FF7769), ref: 00FF75F3
GetLastError.KERNEL32(?,?,00FF777F,?,?,?,?,?,00FF7769), ref: 00FF75FF

Part of subcall function 00FE92EB: __EH_prolog3_GS.LIBCMT ref: 00FE92F2

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00FF7608

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: ErrorH_prolog3_LastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 2419225763-2248577382
Opcode ID: 238f1e4fddc676cae47051abb50db5470fc66b27c92198c16ff2775defbbb6dd
Instruction ID: c71d1fd81a0067dda4e977250d2b773565821e41f823292f65cb5a16b49a8c55
Opcode Fuzzy Hash: 238f1e4fddc676cae47051abb50db5470fc66b27c92198c16ff2775defbbb6dd
Instruction Fuzzy Hash: 88D02E3188C43037E822326A9C0ACAE39049F12330F21070CF378A52E9CA6D088293AD

Function 00FF3E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000000,?,00000000,00200000,?,?,00000000,0000005C,3ACC59D7), ref: 00FF3E65
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00FF3E73

Strings

RTL, xrefs: 00FF3E6D

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: bf87e3860607585d81c77f8aa58c1c5944def06c0a1bf4522e5148e09c157948
Instruction ID: bcf55c2424d002b0e343e1ca55ba51a3c84b8c13fab26530ed019e2e53072d29
Opcode Fuzzy Hash: bf87e3860607585d81c77f8aa58c1c5944def06c0a1bf4522e5148e09c157948
Instruction Fuzzy Hash: 75C01231A8031056F73116716E0DB532D585F05719F05044CB68999085D5FED4408B90

Function 01012B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 01012B90
GetCommandLineW.KERNEL32 ref: 01012B9B

Strings

X'q, xrefs: 01012B96

Memory Dump Source

Source File: 00000000.00000002.2194919423.0000000000FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.2194893447.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194961597.000000000101C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001029000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2194985261.0000000001032000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2195061641.0000000001037000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_p2K.jbxd

Similarity

API ID: CommandLine
String ID: X'q
API String ID: 3253501508-1613321685
Opcode ID: 1ec3496ee54a47208fb6568a20ab3694a0050d42ccf57b318aaf28870a23fb46
Instruction ID: a1b4ae81cea6e308d243145489d3d0aa0f4a03af2e7f29db5ac4a4ad7a8ee4f3
Opcode Fuzzy Hash: 1ec3496ee54a47208fb6568a20ab3694a0050d42ccf57b318aaf28870a23fb46
Instruction Fuzzy Hash: 0AB048788903009FAB218F30A1190043AE4F62B3023C05456D88982208E73F91018F00

Analysis Process: assignee.exePID: 5356, Parent PID: 6600COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	661
Total number of Limit Nodes:	28

Executed Functions

Function 6C7A8980 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 349
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TkBindInit.TK86T(?), ref: 6C7A8A41
TkFontPkgInit.TK86T(?), ref: 6C7A8A4D
TkStylePkgInit.TK86T(?), ref: 6C7A8A59
Tk_SetAppName.TK86T(00000000,?), ref: 6C7A8C19
Tk_GetUid.TK86T(00000000), ref: 6C7A8C22

Strings

tk_version, xrefs: 6C7A8D9D
tk_patchLevel, xrefs: 6C7A8D7B
8.6.1, xrefs: 6C7A8D74
TkWindow and Tk_FakeWin are not the same size, xrefs: 6C7A89A4
8.6, xrefs: 6C7A8D96
::tk, xrefs: 6C7A8AF3
::tk::AlwaysShowSelection, xrefs: 6C7A8B30
tk_strictMotif, xrefs: 6C7A8ABE
TkCreateMainWindow: builtin command with NULL string and object procs, xrefs: 6C7A8C6E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Init$BindFontNameStyle
String ID: 8.6$8.6.1$::tk$::tk::AlwaysShowSelection$TkCreateMainWindow: builtin command with NULL string and object procs$TkWindow and Tk_FakeWin are not the same size$tk_patchLevel$tk_strictMotif$tk_version
API String ID: 232771431-2718443210
Opcode ID: 6681c3b339357d271bdf241e67bc51f82cc8a99addf9acc70eb8eb3b313fb3ae
Instruction ID: def761cc5be1f734e9beeedc653497d3a38da3752e7c7a9788aa346d68c7eab0
Opcode Fuzzy Hash: 6681c3b339357d271bdf241e67bc51f82cc8a99addf9acc70eb8eb3b313fb3ae
Instruction Fuzzy Hash: D3E1FFB4A002059FDB04CF94C985FAEB7B5FF89304F248669E8096B751D735AE42CFA1

Function 6C813540 Relevance: 81.1, APIs: 27, Strings: 19, Instructions: 586
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_CreateOptionTable.TK86T(?,00000000,?,?,?,?,?,?,?,?,?,?,6C813D2C,00000000,?), ref: 6C813585
strncmp.MSVCR100 ref: 6C81361D

Strings

Colormap, xrefs: 6C81394D
colormap, xrefs: 6C813952
APPLICATION_GONE, xrefs: 6C813835
-visual, xrefs: 6C81374B
CONTAINMENT, xrefs: 6C813BE6
Visual, xrefs: 6C81392E
Class, xrefs: 6C8138A0
visual, xrefs: 6C813933
windows cannot have both the -use and the -container option set, xrefs: 6C813BBA
-colormap, xrefs: 6C813664
-class, xrefs: 6C813614
unable to create widget "%s", xrefs: 6C813807
-screen, xrefs: 6C8136B4
-use, xrefs: 6C813704
class, xrefs: 6C8138A5
Use, xrefs: 6C8138E2
use, xrefs: 6C8138E7
FRAME, xrefs: 6C813BEB
pathName ?-option value ...?, xrefs: 6C81354C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: CreateOptionTablestrncmp
String ID: -class$-colormap$-screen$-use$-visual$APPLICATION_GONE$CONTAINMENT$Class$Colormap$FRAME$Use$Visual$class$colormap$pathName ?-option value ...?$unable to create widget "%s"$use$visual$windows cannot have both the -use and the -container option set
API String ID: 2822573700-4247450938
Opcode ID: 7578d1301fbdfb5def1d17e053d2589805159044082cc2dd292e980d72640034
Instruction ID: 305eb3a9e4499248cbade513a78b953ff8c6c866a1791b1483a72261dc25cfda
Opcode Fuzzy Hash: 7578d1301fbdfb5def1d17e053d2589805159044082cc2dd292e980d72640034
Instruction Fuzzy Hash: 78324FB4A04209EFCB14CF98DD84EEEB7F5BB49314F148A68E805A7B41D735AD45CB90

Function 6C7E4940 Relevance: 52.8, APIs: 28, Strings: 2, Instructions: 306
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_Get3DBorderFromObj.TK86T(6C7E9821,458B1051), ref: 6C7E4960
Tk_SetBackgroundFromBorder.TK86T(00000000,?), ref: 6C7E4975

Part of subcall function 6C857610: Tk_SetWindowBackground.TK86T(?,6C812E95,?,?,6C812E95,?,00000000), ref: 6C857627

Tk_GetFontFromObj.TK86T(6C7E9821,FFFFE293), ref: 6C7E498A
Tk_FontId.TK86T(?), ref: 6C7E4999
Tk_GetColorFromObj.TK86T(6C7E9821,EB0CC483), ref: 6C7E49B1
Tk_3DBorderColor.TK86T(?), ref: 6C7E49CE
Tk_GetGC.TK86T(?,0000400C,?), ref: 6C7E49EA

Part of subcall function 6C811240: memset.MSVCR100 ref: 6C81127F

Tk_GetBitmap.TK86T(09EB0000,?,gray50), ref: 6C7E4AA3
Tk_FreeGC.TK86T(0000F845,8BFC458B), ref: 6C7E4B9F
Tk_FontId.TK86T(?), ref: 6C7E4BB7
Tk_GetColorFromObj.TK86T(6C7E9821,BD65E850), ref: 6C7E4BCF
Tk_Get3DBorderFromObj.TK86T(6C7E9821,6ADC4D89), ref: 6C7E4BEF
Tk_3DBorderColor.TK86T(?), ref: 6C7E4BFE
Tk_GetGC.TK86T(?,0000400C,?), ref: 6C7E4C1A
Tk_FreeGC.TK86T(0000F845,89000000), ref: 6C7E4C3F
Tk_GetColorFromObj.TK86T(6C7E9821,C483FFFF), ref: 6C7E4C60
Tk_3DBorderColor.TK86T(?), ref: 6C7E4C77
Tk_GetGC.TK86T(?,0000400C,?), ref: 6C7E4C93
Tk_FreeGC.TK86T(0000F845,4D8BFFFF), ref: 6C7E4A0F

Part of subcall function 6C811130: TkGetDisplay.TK86T(6C857F39,6C857741,6C857F39,?,?,?,6C857F39,00000000,?,00000000), ref: 6C81113A

Tk_FontId.TK86T(?), ref: 6C7E4A27
Tk_3DBorderColor.TK86T(?), ref: 6C7E4A36
Tk_GetColorFromObj.TK86T(6C7E9821,F4458BCB), ref: 6C7E4A59
Tk_GetGC.TK86T(?,00000004,?), ref: 6C7E4ADF
Tk_FreeGC.TK86T(0000F845,94918B0C), ref: 6C7E4B04
Tk_3DBorderColor.TK86T(?), ref: 6C7E4B1C
Tk_GetBitmap.TK86T(09EB0000,?,gray50), ref: 6C7E4B44
Tk_GetGC.TK86T(FC22E904,00000904,?), ref: 6C7E4B7A
Tk_FreeGC.TK86T(0000F845,0CEBFC55), ref: 6C7E4CB8

Part of subcall function 6C811130: XGContextFromGC.TK86T(?), ref: 6C8111D2
Part of subcall function 6C811130: Tk_FreeXId.TK86T(00000000,00000000), ref: 6C8111E2
Part of subcall function 6C811130: XFreeGC.TK86T(00000000), ref: 6C8111F7

Strings

gray50, xrefs: 6C7E4A91
gray50, xrefs: 6C7E4B32

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ColorFrom$Border$Free$Tk_3$Font$BackgroundBitmapGet3$ContextDisplayWindowmemset
String ID: gray50$gray50
API String ID: 3425720916-1068176580
Opcode ID: a0d332d401cceff417b3f25e9b5f68416ea52bbb6c4c314b2ae3e8e39a4c49d8
Instruction ID: 6c0bd706a4a7ee9dbf9cdd069b908b7c20842aa7dcbc06d04f221bfd7a4c8094
Opcode Fuzzy Hash: a0d332d401cceff417b3f25e9b5f68416ea52bbb6c4c314b2ae3e8e39a4c49d8
Instruction Fuzzy Hash: 74D13FB5A00208EFCB14CF98D980E9DBBB5BF88358F10C568E9499B751E731E985CF90

Function 6C7A8DD0 Relevance: 51.4, APIs: 8, Strings: 21, Instructions: 632
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NO_MASTER, xrefs: 6C7A8F35
::safe::TkInit, xrefs: 6C7A901E
error in Tcl_GetInterpPath, xrefs: 6C7A8FAF
geometry, xrefs: 6C7A951D
argc, xrefs: 6C7A9255
argv, xrefs: 6C7A915F
SAFE, xrefs: 6C7A8F3A
if {[namespace which -command tkInit] eq ""} { proc tkInit {} { global tk_library tk_version tk_patchLevel rename tkInit {} tcl_findLibrary tk $tk_version $tk_patchLevel tk.tcl TK_LIBRARY tk_library }}tkInit, xrefs: 6C7A9682
wm geometry . , xrefs: 6C7A954F
8.6.1, xrefs: 6C7A95E1
(processing arguments in argv variable), xrefs: 6C7A91AB
FAILED, xrefs: 6C7A8FDD
FAILED, xrefs: 6C7A90EE
8.6, xrefs: 6C7A8DF1
SAFE, xrefs: 6C7A90F3
no controlling master interpreter, xrefs: 6C7A8F07
env, xrefs: 6C7A93CB
argv, xrefs: 6C7A9217
not allowed to start Tk by master's safe::TkInit, xrefs: 6C7A90C2
DISPLAY, xrefs: 6C7A93C6
SAFE, xrefs: 6C7A8FE2

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: (processing arguments in argv variable)$8.6$8.6.1$::safe::TkInit$DISPLAY$FAILED$FAILED$NO_MASTER$SAFE$SAFE$SAFE$argc$argv$argv$env$error in Tcl_GetInterpPath$geometry$if {[namespace which -command tkInit] eq ""} { proc tkInit {} { global tk_library tk_version tk_patchLevel rename tkInit {} tcl_findLibrary tk $tk_version $tk_patchLevel tk.tcl TK_LIBRARY tk_library }}tkInit$no controlling master interpreter$not allowed to start Tk by master's safe::TkInit$wm geometry .
API String ID: 0-759825338
Opcode ID: 94eee62fc159154026b903419425d7f77b280b796902558d509559739333a47a
Instruction ID: a872b4917fcbf4a411ccb774484a7af7b7bd5acd2d52b59164cc880485254ecb
Opcode Fuzzy Hash: 94eee62fc159154026b903419425d7f77b280b796902558d509559739333a47a
Instruction Fuzzy Hash: 47424C70A00204AFDF14DF88CD85FDE73B5EB89318F144679E8199B7A4D735AA86CB90

Function 6C7CF850 Relevance: 38.9, APIs: 16, Strings: 6, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_CreateWindowFromPath.TK86T(?,?,00000000), ref: 6C7CF879

Part of subcall function 6C7A8410: strrchr.MSVCR100 ref: 6C7A8426

memset.MSVCR100 ref: 6C7CF8B4
memset.MSVCR100 ref: 6C7CF935

Strings

flat, xrefs: 6C7CFC53
flat, xrefs: 6C7CFC36
sel, xrefs: 6C7CFBF4
current, xrefs: 6C7CFC68
insert, xrefs: 6C7CFC86
Text, xrefs: 6C7CFCB4

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: memset$CreateFromPathWindowstrrchr
String ID: Text$current$flat$flat$insert$sel
API String ID: 1981307918-306729379
Opcode ID: 71aebeac31cd520868455b7ed922407a4c49cc13a9071cfb65c98c611a2aa372
Instruction ID: 3b1720681409011f62cf68c46e3194d16674aa5f47398a619fbbdb48a8214d60
Opcode Fuzzy Hash: 71aebeac31cd520868455b7ed922407a4c49cc13a9071cfb65c98c611a2aa372
Instruction Fuzzy Hash: 61020AB8A0020A9FDB04CF94D895FEAB7B1FF88304F148569ED189B341D779E946CB91

Function 6C872430 Relevance: 37.0, APIs: 10, Strings: 11, Instructions: 204
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR100 ref: 6C872478
KiUserCallbackDispatcher.NTDLL(00000029,000001F4,000001F4,00000000), ref: 6C87249A
SystemParametersInfoW.USER32(0000002D,0000006C,0000006C,00000000), ref: 6C872592
memset.MSVCR100 ref: 6C87263B
GetDC.USER32(00000000), ref: 6C872645
GetDeviceCaps.GDI32(?,0000005A), ref: 6C87265A
MulDiv.KERNEL32(?,00000048,?), ref: 6C872676
MulDiv.KERNEL32(?,?,00000048), ref: 6C872697
ReleaseDC.USER32(00000000,?), ref: 6C8726AE

Part of subcall function 6C8723F0: CreateFontIndirectW.GDI32(?), ref: 6C8723FA
Part of subcall function 6C8723F0: DeleteObject.GDI32(?), ref: 6C872422

GetStockObject.GDI32(00000000), ref: 6C8726F4

Part of subcall function 6C872360: _InternalDeleteHelper.LIBCMTD ref: 6C8723C6

Strings

TkHeadingFont, xrefs: 6C8724CE
TkTooltipFont, xrefs: 6C87252B
TkCaptionFont, xrefs: 6C87254A
l, xrefs: 6C872581
TkDefaultFont, xrefs: 6C8724AF
TkMenuFont, xrefs: 6C87250C
1, xrefs: 6C87261B
TkTextFont, xrefs: 6C8724ED
TkFixedFont, xrefs: 6C8726BB
TkSmallCaptionFont, xrefs: 6C872569
TkIconFont, xrefs: 6C8725A0

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: DeleteObjectmemset$CallbackCapsCreateDeviceDispatcherFontHelperIndirectInfoInternalParametersReleaseStockSystemUser
String ID: 1$TkCaptionFont$TkDefaultFont$TkFixedFont$TkHeadingFont$TkIconFont$TkMenuFont$TkSmallCaptionFont$TkTextFont$TkTooltipFont$l
API String ID: 1626184075-826797912
Opcode ID: 62400507edac95b754b11442140ec5e403445240f778a272d16c48b44f68b512
Instruction ID: aa14c56fd6e039d6a01901138c9b8643ac1104f019440095a0c7e37ddd2bccf2
Opcode Fuzzy Hash: 62400507edac95b754b11442140ec5e403445240f778a272d16c48b44f68b512
Instruction Fuzzy Hash: 09812FB5A00118AFDB24DB98CD88FEEB778EB49304F1089D9F508A7641DB759E84CF61

Function 6C84FD10 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 144
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_DefineBitmap.TK86T(?,error,6C8BD1E0,00000011,00000011), ref: 6C84FD82
Tk_DefineBitmap.TK86T(?,gray75,6C8BD274,00000010,00000010), ref: 6C84FD9C
Tk_DefineBitmap.TK86T(?,gray50,6C8BD254,00000010,00000010), ref: 6C84FDB6
Tk_DefineBitmap.TK86T(?,gray25,6C8BD234,00000010,00000010), ref: 6C84FDD0
Tk_DefineBitmap.TK86T(?,gray12,6C8BD214,00000010,00000010), ref: 6C84FDEA
Tk_DefineBitmap.TK86T(?,hourglass,6C8BD294,00000013,00000015), ref: 6C84FE04
Tk_DefineBitmap.TK86T(?,info,6C8BD2D4,00000008,00000015), ref: 6C84FE1E
Tk_DefineBitmap.TK86T(?,questhead,6C8BD300,00000014,00000016), ref: 6C84FE38
Tk_DefineBitmap.TK86T(?,question,6C8BD380,00000011,0000001B), ref: 6C84FE52
Tk_DefineBitmap.TK86T(?,warning,6C8BD2EC,00000006,00000013), ref: 6C84FE6C

Strings

hourglass, xrefs: 6C84FDFB
gray75, xrefs: 6C84FD93
gray12, xrefs: 6C84FDE1
info, xrefs: 6C84FE15
gray50, xrefs: 6C84FDAD
question, xrefs: 6C84FE49
questhead, xrefs: 6C84FE2F
warning, xrefs: 6C84FE63
error, xrefs: 6C84FD79
gray25, xrefs: 6C84FDC7

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: BitmapDefine
String ID: error$gray12$gray25$gray50$gray75$hourglass$info$questhead$question$warning
API String ID: 1950699371-2282021061
Opcode ID: 1298a9ae164c92ade9e09e1bae1030c4f60b6ec1eefac0c808c9862992205584
Instruction ID: e5173a495d4cd99b6836df933cc939b845b86ee9195131cca1c2ccfffd8ccd6c
Opcode Fuzzy Hash: 1298a9ae164c92ade9e09e1bae1030c4f60b6ec1eefac0c808c9862992205584
Instruction Fuzzy Hash: F0518274A80208BBDB34DB58DE46FCA33609B5870CF108D79BA047B7C7D675AA50EB90

Function 6C7829F0 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_CreateOptionTable.TK86T(?,?), ref: 6C782A28
Tk_MainWindow.TK86T(?,00000000), ref: 6C782B99
Tk_CreateWindowFromPath.TK86T(?,00000000,00000000), ref: 6C782BA6
memset.MSVCR100 ref: 6C782BF1
Tk_SetClass.TK86T(00000000,?), ref: 6C782CA2

Part of subcall function 6C7A6490: Tk_GetUid.TK86T(?), ref: 6C7A649E
Part of subcall function 6C7A6490: TkWmSetClass.TK86T(?), ref: 6C7A64C1
Part of subcall function 6C7A6490: TkOptionClassChanged.TK86T(?), ref: 6C7A64CD

Tk_SetClassProcs.TK86T(00000000,6C89D020,?), ref: 6C782CBA
Tk_SetWindowBackgroundPixmap.TK86T(00000000,00000001), ref: 6C782CC8

Part of subcall function 6C7A63D0: XSetWindowBackgroundPixmap.TK86T(?,00000000,?), ref: 6C7A63FD

Tk_CreateEventHandler.TK86T(00000000,60228030,6C7826A0,?), ref: 6C782D00
Tk_InitOptions.TK86T(?,?,?,00000000), ref: 6C782D36
Tk_SetOptions.TK86T(?,?,?,00000000,-00000008,00000000,?,00000000), ref: 6C782D74
Tk_RestoreSavedOptions.TK86T(?), ref: 6C782D87
Tk_DestroyWindow.TK86T(00000000), ref: 6C782EA3

Strings

-class, xrefs: 6C782AA3
pathName ?-option value ...?, xrefs: 6C782A50
widget has been destroyed, xrefs: 6C782E71

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$Class$CreateOptions$BackgroundOptionPixmap$ChangedDestroyEventFromHandlerInitMainPathProcsRestoreSavedTablememset
String ID: -class$pathName ?-option value ...?$widget has been destroyed
API String ID: 1508506298-1424600322
Opcode ID: 8205981f3e573132f4fab3045cf54dc24fa9144999bbf343d0744524e1750e3f
Instruction ID: ed52b33d3cdb8fb227ad649801c57ca2bf2f6bb1cef5cb11081dfba1ad717a18
Opcode Fuzzy Hash: 8205981f3e573132f4fab3045cf54dc24fa9144999bbf343d0744524e1750e3f
Instruction Fuzzy Hash: 6CE16DB5A00218AFCB14CF58CD84FDAB3B5AB49314F1482E8E90D9B751DB31AE81CF91

Function 6C7EA8E0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_MainWindow.TK86T(?), ref: 6C7EA8EA
Tk_CreateWindowFromPath.TK86T(00000002,?,?,00000001), ref: 6C7EA9FC

Strings

-menu, xrefs: 6C7EADA9
-menu, xrefs: 6C7EAC49
Menu, xrefs: 6C7EAAD0
pathName ?-option value ...?, xrefs: 6C7EA901
normal, xrefs: 6C7EAD19

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$CreateFromMainPath
String ID: -menu$-menu$Menu$normal$pathName ?-option value ...?
API String ID: 636362913-1356656311
Opcode ID: b5787ebd4888738e70bfa68d1cfede7a9a8dd62cff786f622df5614b7e1fdb7b
Instruction ID: ce8f659d6153ef9528b44fadfe1ca442adf6befcb700adb1b26618f8c354b741
Opcode Fuzzy Hash: b5787ebd4888738e70bfa68d1cfede7a9a8dd62cff786f622df5614b7e1fdb7b
Instruction Fuzzy Hash: 2F320C75A002089FCB04CF98D984E9EBBB6FF8D324F148268E915AB755D731AD46CF90

Function 6C850220 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 351
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

native bitmap creation failed, xrefs: 6C850545
error reading bitmap file "%s", xrefs: 6C8503F6
BITMAP, xrefs: 6C8504EA
BITMAP_FILE, xrefs: 6C85034B
bitmap "%s" not defined, xrefs: 6C8504B8
BITMAP, xrefs: 6C850429
bitmap already registered in Tk_GetBitmap, xrefs: 6C85061E
LOOKUP, xrefs: 6C8504EF
FILE_ERROR, xrefs: 6C850424
can't specify bitmap with '@' in a safe interpreter, xrefs: 6C85031F
SAFE, xrefs: 6C850350

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: BitmapDefine
String ID: BITMAP$BITMAP$BITMAP_FILE$FILE_ERROR$LOOKUP$SAFE$bitmap "%s" not defined$bitmap already registered in Tk_GetBitmap$can't specify bitmap with '@' in a safe interpreter$error reading bitmap file "%s"$native bitmap creation failed
API String ID: 1950699371-3317399853
Opcode ID: 6990c05caba6c8421fbb1dd306c1d1304cb9d5e0ab76c20f5445c2126ef97a3e
Instruction ID: dd82e53c274bc31047c8f56abb4b16dfd453a79bd0e505a3db9b1d11311e9347
Opcode Fuzzy Hash: 6990c05caba6c8421fbb1dd306c1d1304cb9d5e0ab76c20f5445c2126ef97a3e
Instruction Fuzzy Hash: E7E14D74A00208EFCB54CF84D980EDEB3B5FF88318F148669E819AB755D775AA81CF90

Function 6C7A56B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 105
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconW.USER32(00000000,00007F00), ref: 6C7A5769
LoadIconW.USER32(00000000,00007F00), ref: 6C7A577C
LoadCursorW.USER32(00000000,00007F00), ref: 6C7A578F
RegisterClassExW.USER32(00000030), ref: 6C7A57C4
CreateWindowExW.USER32(00000000,?,?,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,Lkyl,00000000), ref: 6C7A5801
SetWindowLongW.USER32(00000000,000000EB,?), ref: 6C7A581A
ShowWindow.USER32(00000000,00000000), ref: 6C7A5829
UpdateWindow.USER32(00000000), ref: 6C7A5836

Strings

8.6, xrefs: 6C7A56C4
TtkMonitorWindow, xrefs: 6C7A56D4
TtkMonitorClass, xrefs: 6C7A5700
0, xrefs: 6C7A5727
Lkyl, xrefs: 6C7A5759, 6C7A57D3, 6C7A57D6

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$Load$Icon$ClassCreateCursorLongRegisterShowUpdate
String ID: 0$8.6$Lkyl$TtkMonitorClass$TtkMonitorWindow
API String ID: 1906826020-2344769389
Opcode ID: 604c34630ec0d3d906295b369db35f61ff900730c88dc4d996132e7f1e442d53
Instruction ID: 0ec44726ed2afdba8350304db9f4a170129cbf5b2eaa2444e179585a440642ae
Opcode Fuzzy Hash: 604c34630ec0d3d906295b369db35f61ff900730c88dc4d996132e7f1e442d53
Instruction Fuzzy Hash: EB41D571E04318DFEB64CFA8CC05B9EBBB5FB49304F1080AAE509AB280DB745A45CF95

Function 6C826D10 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 264
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_InitOptions.TK86T(00000001,?,00000000,6C813B78), ref: 6C826D45
Tk_GetOption.TK86T(00000002,00000000,00000000), ref: 6C826DCD
TkpGetSystemDefault.TK86T(00000002,00000000,00000000), ref: 6C826E1F
sprintf.MSVCR100 ref: 6C826F00
sprintf.MSVCR100 ref: 6C826FB4

Strings

in widget "%.50s"), xrefs: 6C826FA1
(database entry for "%.50s"), xrefs: 6C826EF4
(system default for "%.50s"), xrefs: 6C826F14
(default value for "%.50s"), xrefs: 6C826F34

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: sprintf$DefaultInitOptionOptionsSystem
String ID: (database entry for "%.50s")$ (default value for "%.50s")$ (system default for "%.50s")$ in widget "%.50s")
API String ID: 3699689831-3381673809
Opcode ID: 27a6a630726e031a8e87eb5fbd7a8b85f9b5920294f546d5ed6b864d4c114bdd
Instruction ID: 9f730327aae920f87bfeaebbc7fba58dcb2fd2980602978f13b9cc545e93cb15
Opcode Fuzzy Hash: 27a6a630726e031a8e87eb5fbd7a8b85f9b5920294f546d5ed6b864d4c114bdd
Instruction Fuzzy Hash: 10C10D74A0010ADFCB24CF98C985BAEB7B1FF49308F1085A9E919A7751D735AAC5CF90

Function 6C8695A0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 81
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Tk_GetHINSTANCE.TK86T(00000000,?,6C7E7CB7,?,6C86D216,?,6C86411D), ref: 6C8695C3

Part of subcall function 6C858B30: GetModuleHandleW.KERNEL32(00000000,?,6C8623C2,00000000), ref: 6C858B3E

CreateWindowExW.USER32(00000000,MenuWindowClass,MenuWindow,80000000,00000000,00000000,0000000A,0000000A,00000000,00000000,00000000,00000000), ref: 6C8695E6
Tk_GetHINSTANCE.TK86T(00000000,?,6C7E7CB7,?,6C86D216,?,6C86411D), ref: 6C869610
CreateWindowExW.USER32(00000000,EmbeddedMenuWindowClass,EmbeddedMenuWindow,80000000,00000000,00000000,0000000A,0000000A,00000000,00000000,00000000,00000000), ref: 6C869633
TkCreateThreadExitHandler.TK86T(6C868E70,00000000,?,?,?,?,?,?,?,6C86D216,?,6C86411D), ref: 6C869693

Strings

MenuWindow, xrefs: 6C8695DA
EmbeddedMenuWindow, xrefs: 6C869627
Failed to create the menu window, xrefs: 6C8695FB
Failed to create the embedded menu window, xrefs: 6C869648
MenuWindowClass, xrefs: 6C8695DF
EmbeddedMenuWindowClass, xrefs: 6C86962C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Create$Window$ExitHandleHandlerModuleThread
String ID: EmbeddedMenuWindow$EmbeddedMenuWindowClass$Failed to create the embedded menu window$Failed to create the menu window$MenuWindow$MenuWindowClass
API String ID: 912037273-1932805642
Opcode ID: dd8e382ce035f3a6b5f0a5c1d4120a4969b427030c788ca90aa59533bf317eec
Instruction ID: 25be3c37f6735a5934d0115f21e1617f4a269b1ff0d9f25e935919c573c45b42
Opcode Fuzzy Hash: dd8e382ce035f3a6b5f0a5c1d4120a4969b427030c788ca90aa59533bf317eec
Instruction Fuzzy Hash: 3E217C30B90308BBE734CB44CD46F5873A1EB4171AF248968FA093B7D1C6B5AD41DB56

Function 6C870460 Relevance: 13.7, APIs: 9, Instructions: 181
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 6C8704AD
SelectObject.GDI32(?,?), ref: 6C8704C4
GetTextMetricsA.GDI32(?,?), ref: 6C8704DE
GetTextFaceW.GDI32(?,00000020,?), ref: 6C8704F4
Tk_GetUid.TK86T(?), ref: 6C87055E
GetCharWidthW.GDI32(?,00000000,0000007F,6C8722F3), ref: 6C870691
GetCharWidthA.GDI32(?,00000000,0000007F,6C8722F3), ref: 6C8706AD
SelectObject.GDI32(?,?), ref: 6C8706D8
ReleaseDC.USER32(?,?), ref: 6C8706EC

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: CharObjectSelectTextWidth$FaceMetricsRelease
String ID:
API String ID: 1149465119-0
Opcode ID: 9a0b377cd637f6b16583ac7e3189b9b8682b6f3b93d23990fc2725e423cc15af
Instruction ID: de07c03c3665049b6178d22e7154fa03198717423e722accbdc7f997d62e7b05
Opcode Fuzzy Hash: 9a0b377cd637f6b16583ac7e3189b9b8682b6f3b93d23990fc2725e423cc15af
Instruction Fuzzy Hash: 1981FAB5A042199FCB24CF68C984BDAB7B5FF49304F1086A9E90DA7341D735AE91CF90

Function 6C85A2D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(0000001F,?,?,?), ref: 6C85A3E0
Tk_TranslateWinEvent.TK86T(00000400,?,?,?,?), ref: 6C85A463
DefWindowProcW.USER32(00000400,?,?,?), ref: 6C85A47F

Strings

Q, xrefs: 6C85A2E2

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ProcWindow$EventTranslate
String ID: Q
API String ID: 1169340640-3463352047
Opcode ID: 306446c3e085d7e388e87f139813bced732c02e7a72d9efcf3009821829916de
Instruction ID: 206ca935541483caf1fc93391bc2195d2793146d95beef95227e70a5c6b9e33d
Opcode Fuzzy Hash: 306446c3e085d7e388e87f139813bced732c02e7a72d9efcf3009821829916de
Instruction Fuzzy Hash: E8515DB5904209EFCB60CFD8DA84AEF77B9AF49708F508959F90897640D3B0DA61CB71

Function 6C7E9480 Relevance: 12.3, APIs: 8, Instructions: 329windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

Tk_SetOptions.TK86T(00000002,00000000,?,?,6C7EA75E,00000000,?,00000000,?,?,?,?,?,6C7EA75E,?), ref: 6C7E94F5

Part of subcall function 6C827080: Tk_RestoreSavedOptions.TK86T(00000000), ref: 6C8272C2

Tk_RestoreSavedOptions.TK86T(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7EA75E), ref: 6C7E9536
Tk_RestoreSavedOptions.TK86T(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7EA75E), ref: 6C7E957B
TkpMakeMenuWindow.TK86T(6C7EA75E,00000001), ref: 6C7E9648
TkpMakeMenuWindow.TK86T(?,00000000), ref: 6C7E9663

Part of subcall function 6C85F780: Tk_ChangeWindowAttributes.TK86T(?,00000600,?), ref: 6C85F7DA

Part of subcall function 6C7E4940: Tk_Get3DBorderFromObj.TK86T(6C7E9821,458B1051), ref: 6C7E4960
Part of subcall function 6C7E4940: Tk_SetBackgroundFromBorder.TK86T(00000000,?), ref: 6C7E4975
Part of subcall function 6C7E4940: Tk_GetFontFromObj.TK86T(6C7E9821,FFFFE293), ref: 6C7E498A
Part of subcall function 6C7E4940: Tk_FontId.TK86T(?), ref: 6C7E4999
Part of subcall function 6C7E4940: Tk_GetColorFromObj.TK86T(6C7E9821,EB0CC483), ref: 6C7E49B1
Part of subcall function 6C7E4940: Tk_3DBorderColor.TK86T(?), ref: 6C7E49CE
Part of subcall function 6C7E4940: Tk_GetGC.TK86T(?,0000400C,?), ref: 6C7E49EA
Part of subcall function 6C7E4940: Tk_FreeGC.TK86T(0000F845,4D8BFFFF), ref: 6C7E4A0F
Part of subcall function 6C7E4940: Tk_FontId.TK86T(?), ref: 6C7E4A27
Part of subcall function 6C7E4940: Tk_3DBorderColor.TK86T(?), ref: 6C7E4A36
Part of subcall function 6C7E4940: Tk_GetColorFromObj.TK86T(6C7E9821,F4458BCB), ref: 6C7E4A59

Part of subcall function 6C7E7AF0: Tk_SetOptions.TK86T(?,00000002,?,?,6C7E82F0,?,?,00000000), ref: 6C7E7BAE

Tk_RestoreSavedOptions.TK86T(?), ref: 6C7E96D6
Tk_RestoreSavedOptions.TK86T(?), ref: 6C7E971A
Tk_FreeSavedOptions.TK86T(?,?,?,?,?,?,6C7EA75E,?), ref: 6C7E989D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Options$Saved$FromRestore$BorderColor$FontWindow$FreeMakeMenuTk_3$AttributesBackgroundChangeGet3
String ID:
API String ID: 3945254400-0
Opcode ID: 6a73ccb4df6d738f29ae34a93cd7a419f0ccf34a53c78649037b8f4b0473973e
Instruction ID: 128906a72e3d5fa6e67b7ff83d5f0ab1a7f98d65b8c013f9df37897a26d44080
Opcode Fuzzy Hash: 6a73ccb4df6d738f29ae34a93cd7a419f0ccf34a53c78649037b8f4b0473973e
Instruction Fuzzy Hash: 27E1E676A00208EFDB08CF94C594FDEB3B1FB99308F2482A9D8156B751D735EA42CB91

Function 6C86F630 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_stricmp.MSVCR100(6C870153,Courier), ref: 6C86F64C
_stricmp.MSVCR100(6C870153,Times), ref: 6C86F669

Strings

Courier, xrefs: 6C86F643
Times, xrefs: 6C86F660
Helvetica, xrefs: 6C86F67D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: _stricmp
String ID: Courier$Helvetica$Times
API String ID: 2884411883-1931547285
Opcode ID: e78bdcbd748b5a4382de73fd40cc13daf515c13b364f59385a306582b5ea192c
Instruction ID: 21bcabf9b72d58b711fe246a4168f959e535c3dbd9a4e0513abdd042d7d8634c
Opcode Fuzzy Hash: e78bdcbd748b5a4382de73fd40cc13daf515c13b364f59385a306582b5ea192c
Instruction Fuzzy Hash: D3219D31701109ABCF20CF69CE44F9A73B9EF49305F048E79A91AD7A54EA30EE55CB94

Function 6C8701C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

SelectObject.GDI32(00000001,?), ref: 6C8701F8
GetTextFaceW.GDI32(00000001,00000020,?), ref: 6C87020E
Tk_GetUid.TK86T(?), ref: 6C870242
SelectObject.GDI32(00000001,?), ref: 6C87026D
memset.MSVCR100 ref: 6C8702D6

Strings

unicode, xrefs: 6C870375

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ObjectSelect$FaceTextmemset
String ID: unicode
API String ID: 920176757-3551638624
Opcode ID: 91259e0410f8d58c0b7d059f6638edf6f70425bf3589a88c9e80b90f3eba67ce
Instruction ID: c7a974c2a8b9ad940ff2ab423464a0e261e99f094b70a4ffa20c972179faba84
Opcode Fuzzy Hash: 91259e0410f8d58c0b7d059f6638edf6f70425bf3589a88c9e80b90f3eba67ce
Instruction Fuzzy Hash: 24711874A00208EFDB14CF58C994F9EBBB5FF49314F1085A9E909AB791D735AA81CF90

Function 6C866570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

Tk_GetHWND.TK86T(00000000), ref: 6C866580
Tk_GetHINSTANCE.TK86T(00000000), ref: 6C8665A4
CreateWindowExW.USER32(00000004,TkChild,00000000,82000000,?,?,?,?,00000000,00000000,00000000,00000000), ref: 6C8665D9
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 6C8665F2
Tk_AttachHWND.TK86T(00000000,00000000), ref: 6C866600

Strings

TkChild, xrefs: 6C8665D2

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$AttachCreate
String ID: TkChild
API String ID: 1792286436-227893619
Opcode ID: ac825f4aeb8f9d933db1e9493e21a6ee521da9177582cdf39f950912f85c8b78
Instruction ID: 3feb7aa8aca28840bffb39f6718b6c664155144995a6ed3bbf8e9bd1f27f5796
Opcode Fuzzy Hash: ac825f4aeb8f9d933db1e9493e21a6ee521da9177582cdf39f950912f85c8b78
Instruction Fuzzy Hash: 221139B5A40208BFDB10DF99D985F9E7BB9EB48304F108598FA099B781D671EA40CB91

Function 6C7DD520 Relevance: 9.3, APIs: 6, Instructions: 349stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.MSVCR100 ref: 6C7DD579
Tk_GetUid.TK86T(-00000001), ref: 6C7DD5A4
Tk_GetUid.TK86T(00000002), ref: 6C7DD5E0
Tk_GetUid.TK86T(00000000), ref: 6C7DD6BF
strncpy.MSVCR100 ref: 6C7DD799
Tk_GetUid.TK86T(?), ref: 6C7DD7AF

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strchrstrncpy
String ID:
API String ID: 3824778938-0
Opcode ID: 4292a0b0468526ce4ddd50619753f3b16694ff47b8f88b1956b955ba38244453
Instruction ID: 3a34c41ca0a5775198bea968239068013fa7fbb13573cdcb76e1bbcea193939a
Opcode Fuzzy Hash: 4292a0b0468526ce4ddd50619753f3b16694ff47b8f88b1956b955ba38244453
Instruction Fuzzy Hash: FDF1B574E01208DFCB04CF98D690A9DBBB2FF98318F258169E815AB745D731AA86CF54

Function 6C7A73C0 Relevance: 9.2, APIs: 6, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

XRootWindow.TK86T(?,00000000), ref: 6C7A740B
XConfigureWindow.TK86T(?,00000000,00000060,?), ref: 6C7A757E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$ConfigureRoot
String ID:
API String ID: 512436310-0
Opcode ID: 5712c12d295649dad30d51d924eb2323eff611509893608dd891c0f9870503eb
Instruction ID: a5aa6d54acf9ef6e3cb590b69d9f5580d369b73c552f56f572268a3d33497662
Opcode Fuzzy Hash: 5712c12d295649dad30d51d924eb2323eff611509893608dd891c0f9870503eb
Instruction Fuzzy Hash: 2081A9B4A00109DFDB04CF98D694BAEB7B1FF48304F248268D419AB755D735AE86CFA1

Function 6C826430 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 419COMMONLIBRARYCODE

Download Yara Rule

Strings

BAD_CONFIG, xrefs: 6C826C02
bad config table: unknown type %d, xrefs: 6C826BD4

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: BAD_CONFIG$bad config table: unknown type %d
API String ID: 0-1772676303
Opcode ID: 4f4d32232aae3e71a2bb334978bb3a4191bee7e45af4d69a7bbd66ab44b40ac9
Instruction ID: da74b7a65d43ff5b10f645b37f4bf5167ad3344aa824596178ede7feb491ac01
Opcode Fuzzy Hash: 4f4d32232aae3e71a2bb334978bb3a4191bee7e45af4d69a7bbd66ab44b40ac9
Instruction Fuzzy Hash: E9121C74A01209DFDB14CF98DA84B9EB7B1FF49304F1085A8E815AB794D738AE85CF91

Function 6C818160 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 372COMMONLIBRARYCODE

Download Yara Rule

Strings

INTERNAL_PROBLEM, xrefs: 6C818457
failed to allocate font due to internal system font engine problem, xrefs: 6C81842B
FONT, xrefs: 6C81845C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: FONT$INTERNAL_PROBLEM$failed to allocate font due to internal system font user problem
API String ID: 0-3144227897
Opcode ID: 213121dc29c0d5d96d82663237aa68519d6cc424848ec70d186e76133a05d997
Instruction ID: d470b105d981b893e1c09d79d1a8c29ff379d8afa3d20db555376a978248998a
Opcode Fuzzy Hash: 213121dc29c0d5d96d82663237aa68519d6cc424848ec70d186e76133a05d997
Instruction Fuzzy Hash: 91F1B574A04209DFCB14CF98C981A9EB7F1FF88318F158669E815AB751D735E982CFA0

Function 6C7A5620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 6C7A562C
DefWindowProcW.USER32(?,00000015,?,?), ref: 6C7A5696

Strings

xpnative, xrefs: 6C7A565C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$LongProc
String ID: xpnative
API String ID: 2275667008-2276800883
Opcode ID: de81871c9ca8ac3feb747ed8abebb2a174107ed4c66736350217e4a562c46fa6
Instruction ID: d0f7f95bb947bfbe5435f0d3b0fe95d134f0d4e6f4f5e0b24c354df8ca3f1430
Opcode Fuzzy Hash: de81871c9ca8ac3feb747ed8abebb2a174107ed4c66736350217e4a562c46fa6
Instruction Fuzzy Hash: C801DEB9D01108FFCF00CFE8EA8899E7BB8AB09305F108269F91593750E7349A01CFA1

Function 6C870700 Relevance: 4.7, APIs: 3, Instructions: 156COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDC.USER32(?), ref: 6C87073D
_stricmp.MSVCR100(00000000,00000000), ref: 6C8707D8
ReleaseDC.USER32(?,?), ref: 6C870849

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Release_stricmp
String ID:
API String ID: 2299790007-0
Opcode ID: 3b1b8658771bb79c09d3977bad003ef2d39ee8599dc0addc7077251f6fa1a115
Instruction ID: 36cddd813d1aa09770d4e42bbba3e37d40a7c572947afdfcde390b5f680bf28d
Opcode Fuzzy Hash: 3b1b8658771bb79c09d3977bad003ef2d39ee8599dc0addc7077251f6fa1a115
Instruction Fuzzy Hash: 5161FAB4D04249DFCB24CF98C980AEEBBB1FF49308F148559E915A7740E736AA45CFA1

Function 6C7A5860 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Tk_GetHINSTANCE.TK86T(Lkyl,?,?,6C796B4C,?,?,?,?,?), ref: 6C7A5868

Part of subcall function 6C858B30: GetModuleHandleW.KERNEL32(00000000,?,6C8623C2,00000000), ref: 6C858B3E

Part of subcall function 6C7A56B0: LoadIconW.USER32(00000000,00007F00), ref: 6C7A5769
Part of subcall function 6C7A56B0: LoadIconW.USER32(00000000,00007F00), ref: 6C7A577C
Part of subcall function 6C7A56B0: LoadCursorW.USER32(00000000,00007F00), ref: 6C7A578F
Part of subcall function 6C7A56B0: RegisterClassExW.USER32(00000030), ref: 6C7A57C4
Part of subcall function 6C7A56B0: CreateWindowExW.USER32(00000000,?,?,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,Lkyl,00000000), ref: 6C7A5801
Part of subcall function 6C7A56B0: SetWindowLongW.USER32(00000000,000000EB,?), ref: 6C7A581A
Part of subcall function 6C7A56B0: ShowWindow.USER32(00000000,00000000), ref: 6C7A5829
Part of subcall function 6C7A56B0: UpdateWindow.USER32(00000000), ref: 6C7A5836

Part of subcall function 6C7A3CF0: GetVersionExW.KERNEL32(00000114), ref: 6C7A3D14

Strings

Lkyl, xrefs: 6C7A5864, 6C7A5882, 6C7A5892, 6C7A58A2, 6C7A5867, 6C7A5885, 6C7A5895, 6C7A58A5

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$Load$Icon$ClassCreateCursorHandleLongModuleRegisterShowUpdateVersion
String ID: Lkyl
API String ID: 1910064509-251523988
Opcode ID: 7dd888082fa2862ead7d4369da3e57ad194e465f01c12a50a263fe0c99b70dee
Instruction ID: 7824b51937957fef227536a465531a9b28105cb0d7af626f9987d23d5dc00a09
Opcode Fuzzy Hash: 7dd888082fa2862ead7d4369da3e57ad194e465f01c12a50a263fe0c99b70dee
Instruction Fuzzy Hash: 96F082BAD10108BBCB40DFE4ED49CDE77BD9B48104B504654F90C97700EA35DF1587A5

Function 6C7A9750 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,Tk_Init), ref: 6C7A9768

Strings

Tk_Init, xrefs: 6C7A975D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: AddressProc
String ID: Tk_Init
API String ID: 190572456-3582206223
Opcode ID: 4a369ad5e730c72637954646bef78a63b4fb9b29f5831e271423af6c272418f6
Instruction ID: e1474661b0ffd32d3a47c060493ce07af49b7503ada6cd95771fab73f98327ee
Opcode Fuzzy Hash: 4a369ad5e730c72637954646bef78a63b4fb9b29f5831e271423af6c272418f6
Instruction Fuzzy Hash: 9CE092B4901208EBDF10DFE4EA4CB9E77789B5620DF108676E90507600DA729B91DBE2

Function 6C7A48D0 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

CreateBitmap.GDI32(00000008,00000008,00000001,00000001,6C8892C8), ref: 6C7A48F3
CreatePatternBrush.GDI32(?), ref: 6C7A4906

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Create$BitmapBrushPattern
String ID:
API String ID: 3280665104-0
Opcode ID: 61a71e0c16edd35cbcf25d2cf863af5727c168e3445571003295ea22646f4296
Instruction ID: 117d90eaf9237c79c7b0b62ccf167256341ae781c89406d818528a1ec7dcd6c2
Opcode Fuzzy Hash: 61a71e0c16edd35cbcf25d2cf863af5727c168e3445571003295ea22646f4296
Instruction Fuzzy Hash: 25F06D74B41204FFDB14CF94CA46E99BBB4EB49300F1086A8F904AB780DA71EE00DB91

Function 6C8723F0 Relevance: 3.0, APIs: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFontIndirectW.GDI32(?), ref: 6C8723FA

Part of subcall function 6C872360: _InternalDeleteHelper.LIBCMTD ref: 6C8723C6

DeleteObject.GDI32(?), ref: 6C872422

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Delete$CreateFontHelperIndirectInternalObject
String ID:
API String ID: 999829947-0
Opcode ID: c98b7d6d6e343350d65f608c62188451dda54f3c4026e87c2fde913307dd746a
Instruction ID: 9f87eb9b66e87f19ed0bfa505abb0d179fd16ab53fb3eb1fe34ee6d644349841
Opcode Fuzzy Hash: c98b7d6d6e343350d65f608c62188451dda54f3c4026e87c2fde913307dd746a
Instruction Fuzzy Hash: 4AE0C079A01208EBCB14DFA8D94589EB7B9EB49204F108599F90997700D630AA10DBA1

Function 6C86FD90 Relevance: 3.0, APIs: 2, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32(8B50E045), ref: 6C86FD9A
DeleteObject.GDI32(458B5214), ref: 6C86FDB0

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 9bc5b568f144e476ef8358c016b38580a12a4d0bd2dcbcdec0de850d04e918ce
Instruction ID: 8cb46aaa97c558e69a6bdbbd074bd47eb316f46aa4b9d227b848a7cdad5bb511
Opcode Fuzzy Hash: 9bc5b568f144e476ef8358c016b38580a12a4d0bd2dcbcdec0de850d04e918ce
Instruction Fuzzy Hash: 47E01A792012089BCB20CF59C488E89B7B9AB492A8B04C694F90D4BB01C734E984CBC0

Function 6C7DD180 Relevance: 1.5, APIs: 1, Instructions: 295COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7DD567,00000000), ref: 6C7DD380

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a890548b51e83fea15236a4a039d4163f3f620d629b963a8397251f78170b173
Instruction ID: 94075b04e68b6cd63150778bd16f53906df07aba7402f79631201746622526a8
Opcode Fuzzy Hash: a890548b51e83fea15236a4a039d4163f3f620d629b963a8397251f78170b173
Instruction Fuzzy Hash: 47E185B4A00209DFCB04CF98C694AADBBB1FF98314F258299D8156B745C731EA81CFA5

Function 6C872360 Relevance: 1.5, APIs: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C870460: GetDC.USER32(?), ref: 6C8704AD
Part of subcall function 6C870460: SelectObject.GDI32(?,?), ref: 6C8704C4
Part of subcall function 6C870460: GetTextMetricsA.GDI32(?,?), ref: 6C8704DE
Part of subcall function 6C870460: GetTextFaceW.GDI32(?,00000020,?), ref: 6C8704F4
Part of subcall function 6C870460: Tk_GetUid.TK86T(?), ref: 6C87055E

_InternalDeleteHelper.LIBCMTD ref: 6C8723C6

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Text$DeleteFaceHelperInternalMetricsObjectSelect
String ID:
API String ID: 1169856299-0
Opcode ID: 2b698f12b86696cfb18764652c92a5840401b0e2296a31a5705d89809c87323c
Instruction ID: 0bb145c5185a7ac36928e95499e161ee07d0bf7ad34befda0f143ebcaa962461
Opcode Fuzzy Hash: 2b698f12b86696cfb18764652c92a5840401b0e2296a31a5705d89809c87323c
Instruction Fuzzy Hash: F00112B5A00208ABCB14DF98DD85EEB73B8AB48304F408598F91D87341E731AA148BA1

Function 6C7E7C30 Relevance: 1.5, APIs: 1, Instructions: 39threadwindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

TkpMenuThreadInit.TK86T(?,6C86D216,?,6C86411D), ref: 6C7E7CB2

Part of subcall function 6C86D130: Tk_GetHINSTANCE.TK86T ref: 6C86D152
Part of subcall function 6C86D130: RegisterClassW.USER32(00000020), ref: 6C86D181
Part of subcall function 6C86D130: RegisterClassW.USER32(00000020), ref: 6C86D1B3

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ClassRegister$InitMenuThread
String ID:
API String ID: 4287971195-0
Opcode ID: 9dae37edb884e9a306b512397d3c98d23a278e17c289300d564428829cdf4c0e
Instruction ID: ede4776a36cdb27177c277531cfcaa9bd23ba598ffc84ae6d20cd1240bbdc842
Opcode Fuzzy Hash: 9dae37edb884e9a306b512397d3c98d23a278e17c289300d564428829cdf4c0e
Instruction Fuzzy Hash: C001A2706003049FEF20DB60DE45B5833B4EB06319F140978D50A5BB90D7766A89EBD2

Function 6C872730 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

TkWinGetPlatformId.TK86T(?,6C81992A,?), ref: 6C872733

Part of subcall function 6C858950: GetVersionExW.KERNEL32(00000114), ref: 6C858981
Part of subcall function 6C858950: memset.MSVCR100 ref: 6C8589E8
Part of subcall function 6C858950: RegOpenKeyExW.ADVAPI32(80000001,6C8C1224,00000000,00020019,?), ref: 6C858A0A

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: OpenPlatformVersionmemset
String ID:
API String ID: 2083054625-0
Opcode ID: 9e04d3d7574e56d36be91c9921efc5e6d67f4f3ff691b4a3b60ab65cbddf5f56
Instruction ID: 12e9a0db58fb6eddec48e463b39ad4f8ec0c71d6ab316c3fa77d889144564d3e
Opcode Fuzzy Hash: 9e04d3d7574e56d36be91c9921efc5e6d67f4f3ff691b4a3b60ab65cbddf5f56
Instruction Fuzzy Hash: 49C012B58501084A4A7057A8660959E366C9B4211C7840D33D40C86B01E768A17886E2

Function 008A10BA Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3366368722.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000002.00000002.3366349194.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366701815.0000000000EBD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366726098.0000000000EC1000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366758835.0000000000EF7000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366758835.0000000000F04000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366758835.0000000000F0A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366819747.0000000000F0B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3366840751.0000000000F0F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8a0000_assignee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bf8e5a26810384fd4634a2c7f4438e8b32ea670bd7214e16251568c6e48894
Instruction ID: 963a77b95f42e261c936f4774957482b81cb3ffda4dd343068350b6724f92190
Opcode Fuzzy Hash: b5bf8e5a26810384fd4634a2c7f4438e8b32ea670bd7214e16251568c6e48894
Instruction Fuzzy Hash: 39B0927080420A5AE700BFAD880A75C7AAABB41745F804168854016687DBFD10495BD2

Non-executed Functions

Function 6C831D00 Relevance: 32.1, APIs: 6, Strings: 12, Instructions: 579COMMON

Download Yara Rule

Strings

CANVAS_ITEM, xrefs: 6C832140
, xrefs: 6C831DAC
tagOrId ?sequence? ?command?, xrefs: 6C83203C
LOOKUP, xrefs: 6C832145
BAD_EVENTS, xrefs: 6C832352
CANVAS, xrefs: 6C832357
option ?arg ...?, xrefs: 6C831D24
item "%s" doesn't exist, xrefs: 6C8320F9
requested illegal events; only key, button, motion, enter, leave, and virtual events may be used, xrefs: 6C832324
tag searchCommand ?arg ...?, xrefs: 6C831DCC
tagOrId ?tagOrId ...?, xrefs: 6C831E46
option, xrefs: 6C831D53

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: $BAD_EVENTS$CANVAS$CANVAS_ITEM$LOOKUP$item "%s" doesn't exist$option$option ?arg ...?$requested illegal events; only key, button, motion, enter, leave, and virtual events may be used$tag searchCommand ?arg ...?$tagOrId ?sequence? ?command?$tagOrId ?tagOrId ...?
API String ID: 0-2095988148
Opcode ID: c0e6045cda6ad2226cd610ff2e622f6654414010c34171065d25049b559d0f46
Instruction ID: 79641cb51f45364424c95553cc3f9dff4e307478f27713a36d6f0ac0dae34bb2
Opcode Fuzzy Hash: c0e6045cda6ad2226cd610ff2e622f6654414010c34171065d25049b559d0f46
Instruction Fuzzy Hash: 5C422FB4A00219DFCB14CFD8C984E9EB3B5FB48314F149668E819AB751C735AA86CFD1

Function 6C85AD70 Relevance: 16.9, APIs: 11, Instructions: 435windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsIconic.USER32(FFFFFF7B), ref: 6C85ADB7
IsZoomed.USER32(FFFFFF7B), ref: 6C85ADC8
AdjustWindowRectEx.USER32(?,8B04C483,00000000,7A83FC55), ref: 6C85AE28
SendMessageW.USER32(FFFFFF7B,00000404,?,?), ref: 6C85B1AF
SendMessageW.USER32(FFFFFF7B,00000401,00000000,00000000), ref: 6C85B1C9

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: MessageSend$AdjustIconicRectWindowZoomed
String ID:
API String ID: 3468695746-0
Opcode ID: 71c940a267a12e60df8e42febd3ab52f00e40077f6028940286e922a36d96bf9
Instruction ID: 0f3ef0b1538ad692dc4fd88e1756d5f40671d58fa3b41e6eda601450b1a0c5b5
Opcode Fuzzy Hash: 71c940a267a12e60df8e42febd3ab52f00e40077f6028940286e922a36d96bf9
Instruction Fuzzy Hash: 0C22D474A00109DFCB58CF98C694AEDB7B2FF88304F2482A9E419AB745C731AE41DF50

Function 6C828E50 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

Tk_NameToWindow.TK86T(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7E7F56), ref: 6C828EB2
TkFreeBindingTags.TK86T(00000000), ref: 6C82907F
Tk_GetUid.TK86T(?), ref: 6C8291CE

Strings

all, xrefs: 6C828FC3
window ?taglist?, xrefs: 6C828E68

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: BindingFreeNameTagsWindow
String ID: all$window ?taglist?
API String ID: 1256710742-1710962531
Opcode ID: 3813cd0aed1dc922dc1ed2bd0977ecb5afc89ab0c797b00e8bfb5a3d5edc7a0e
Instruction ID: 29e512e262607cdf89031157c2ad67eae1ac5a4ed64a7e0d16907c393737cb30
Opcode Fuzzy Hash: 3813cd0aed1dc922dc1ed2bd0977ecb5afc89ab0c797b00e8bfb5a3d5edc7a0e
Instruction Fuzzy Hash: DAC13C74A04209DFCF14CF98C984ADEB7B1FF49314F148668E819AB791C739AA85CB91

Function 6C879CE0 Relevance: 9.0, APIs: 6, Instructions: 25clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 6C879CF1
EmptyClipboard.USER32 ref: 6C879CF7
TkWinGetPlatformId.TK86T ref: 6C879CFD

Part of subcall function 6C858950: GetVersionExW.KERNEL32(00000114), ref: 6C858981
Part of subcall function 6C858950: memset.MSVCR100 ref: 6C8589E8
Part of subcall function 6C858950: RegOpenKeyExW.ADVAPI32(80000001,6C8C1224,00000000,00020019,?), ref: 6C858A0A

SetClipboardData.USER32(0000000D,00000000), ref: 6C879D0B
SetClipboardData.USER32(00000001,00000000), ref: 6C879D17
CloseClipboard.USER32 ref: 6C879D1D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Clipboard$DataOpen$CloseEmptyPlatformVersionmemset
String ID:
API String ID: 3484540602-0
Opcode ID: bbf3b3d0a0b264fef4c34365af989bab8f37b0785b00ab88485edf025ef9e746
Instruction ID: dc8f0e62fa5abb63ff5559bcc65ceb3cec2cceeac945bdeb11b32f5e26d4da0a
Opcode Fuzzy Hash: bbf3b3d0a0b264fef4c34365af989bab8f37b0785b00ab88485edf025ef9e746
Instruction Fuzzy Hash: 34E01B726C110597DA7017A8DD0AB4D3B245F0370EF500433F109599C1EAE15454C6A6

Function 6C879D50 Relevance: 7.7, APIs: 5, Instructions: 182memoryclipboardCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00002002,?), ref: 6C879F22
GlobalLock.KERNEL32(00000000), ref: 6C879F58
memcpy.MSVCR100(?,?,?), ref: 6C879F7C
GlobalUnlock.KERNEL32(00000000), ref: 6C879F8B
SetClipboardData.USER32(0000000D,00000000), ref: 6C879FB1

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Global$AllocClipboardDataLockUnlockmemcpy
String ID:
API String ID: 6447982-0
Opcode ID: a77f0f1c2be5a71ce10c2044e5a019cf9d19b7a47d7fdb727cd8a736531039bb
Instruction ID: 1fb0cb0206e6576af35e92cb90dde5b4d3654a1e2f323078b129ea03491aa711
Opcode Fuzzy Hash: a77f0f1c2be5a71ce10c2044e5a019cf9d19b7a47d7fdb727cd8a736531039bb
Instruction Fuzzy Hash: B381E674A4021ADFDB24CF58CA80BAEB7B1FF49305F1485A9D81967B51E730AE81DF90

Function 6C7B1C80 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

TkTextMakeByteIndex.TK86T(?,?,00000000,00000000,?), ref: 6C7B1C9B

Part of subcall function 6C7B5CB0: TkBTreeNumLines.TK86T(?,?), ref: 6C7B5D0A

TkBTreeNumLines.TK86T(?,?,00000000,?), ref: 6C7B1CB6
TkTextMakeByteIndex.TK86T(?,?,00000000,00000000,?), ref: 6C7B1CCC
Tk_DeleteAllBindings.TK86T(00000000,?), ref: 6C7B1D26

Part of subcall function 6C7C9EC0: memset.MSVCR100 ref: 6C7C9ED8
Part of subcall function 6C7C9EC0: Tk_GetUid.TK86T(Selection), ref: 6C7C9F1B
Part of subcall function 6C7C9EC0: Tk_HandleEvent.TK86T(00000023), ref: 6C7C9F2A

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ByteIndexLinesMakeTextTree$BindingsDeleteEventHandlememset
String ID:
API String ID: 1813278345-0
Opcode ID: 48dff5f1f476c0757a0461bde8f3b9d33aef7e1210006e3ca82fff87c03f8a70
Instruction ID: 90792773dbf14474140274b63c362614bf3c9370fa2596e37701d26fd33dbf8e
Opcode Fuzzy Hash: 48dff5f1f476c0757a0461bde8f3b9d33aef7e1210006e3ca82fff87c03f8a70
Instruction Fuzzy Hash: 38313EBA600108AFCB04DF58D995EEA777ABF88344F14C258FA099F355D731EA45CB90

Function 6C853E40 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 557COMMONLIBRARYCODE

Download Yara Rule

Strings

(command bound to event), xrefs: 6C8545B8

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: (command bound to event)
API String ID: 0-3915131746
Opcode ID: 22ed1ebb6c664d3319700a0060f76e2a173936c063ede2049dcce6cd80addff5
Instruction ID: 1412a2fb8d54c1559edfb45dd33f186b90f1fd81f7c55e80bf643799930a960b
Opcode Fuzzy Hash: 22ed1ebb6c664d3319700a0060f76e2a173936c063ede2049dcce6cd80addff5
Instruction Fuzzy Hash: 9C42F474A00218DFCB64CF48C980BD9B7B2FB89314F5486E9E909AB751C771AE91CF90

Function 6C852DB0 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

Tk_DeleteBinding couldn't find object table entry, xrefs: 6C852E23
Tk_DeleteBinding couldn't find on hash chain, xrefs: 6C852EEB
Tk_DeleteBinding couldn't find on object list, xrefs: 6C852E65

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: isspace
String ID: Tk_DeleteBinding couldn't find object table entry$Tk_DeleteBinding couldn't find on hash chain$Tk_DeleteBinding couldn't find on object list
API String ID: 3785662208-2817996227
Opcode ID: 3832b0aee0f1366fa804342346ea83183bb106f0ea81d3d1f9e27c632ba8ad99
Instruction ID: 3068378c46d32694cda07e409930ca2f4a2fe630749346e0c5ee3f1d14187a1b
Opcode Fuzzy Hash: 3832b0aee0f1366fa804342346ea83183bb106f0ea81d3d1f9e27c632ba8ad99
Instruction Fuzzy Hash: 57512974F10208EFCB58CF84C984D9EB7B2FB48324F548AA9D8155B751DB74EA92CB90

Function 6C787D40 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

Tk_DeleteEventHandler.TK86T(?,4000204F,Function_000055E0,?), ref: 6C787D60
Tk_DeleteBindingTable.TK86T(?), ref: 6C787D6F

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Delete$BindingEventHandlerTable
String ID:
API String ID: 3700505871-0
Opcode ID: 3a4b99df52d3122a63a0c4810947d80bbb07b782d66ab9286878e6e9da6e0045
Instruction ID: 9d6e2f87b5e80656dd5c7491d05fd39c37b1f253467eedb7beb17cddeebfadfa
Opcode Fuzzy Hash: 3a4b99df52d3122a63a0c4810947d80bbb07b782d66ab9286878e6e9da6e0045
Instruction Fuzzy Hash: 9A31A3B9A00104EBDB04CB94EA85EEE73B5AF8430CF2441B8E5055B741E736EF45EB91

Function 6C82EDE0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0fa6be529c5a98184a2e0d5277791e05ed5125736633110b53c56f443e386b
Instruction ID: cb44885424c716fc1d1f4f2b9a0de69b2185a1cd83d3d139a786a356e7b612c7
Opcode Fuzzy Hash: eb0fa6be529c5a98184a2e0d5277791e05ed5125736633110b53c56f443e386b
Instruction Fuzzy Hash: 5061C378A00219DFCB14CF98C584ADEBBB1FF49305F2085A9D815AB751D735AA82CFD4

Function 6C852CC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7766522218adb22176be339a2b9c209316688c6508c9fef45aa792e1a252c883
Instruction ID: d1df41ef9891e5b661a7d34ca9ff2e8ea1102217cc504db04f90a000439a2a7d
Opcode Fuzzy Hash: 7766522218adb22176be339a2b9c209316688c6508c9fef45aa792e1a252c883
Instruction Fuzzy Hash: 93114C74A00208EFCB44DF98C984E9DB7B5FB88314F1486B9E8089B751DB75AE91CF91

Function 6C852D60 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: isspace
String ID:
API String ID: 3785662208-0
Opcode ID: d5e580d48db4ae688ab6c2d4ac3152edef93f8ae1338eb211695773d7414586c
Instruction ID: f82b19c5a573ac80a4f4512a69cd34384d7befbe7ca957ebbb601b3ac4603b02
Opcode Fuzzy Hash: d5e580d48db4ae688ab6c2d4ac3152edef93f8ae1338eb211695773d7414586c
Instruction Fuzzy Hash: BCF0377550010CBBDB10DE58D945F9A77B9AB48304F544698BD04D7241D775D9548790

Function 6C7FBD00 Relevance: 40.6, APIs: 3, Strings: 20, Instructions: 384COMMON

Download Yara Rule

Strings

DIMENSIONS, xrefs: 6C7FBDD5
PPM, xrefs: 6C7FBE4E
PPM image data has bad maximum intensity value %d, xrefs: 6C7FBE1B
INTENSITY, xrefs: 6C7FBE49
couldn't read raw PPM header from string, xrefs: 6C7FBD3B
truncated PPM data, xrefs: 6C7FC0CA
PPM, xrefs: 6C7FBD6C
IMAGE, xrefs: 6C7FC102
PPM, xrefs: 6C7FBDDA
PPM, xrefs: 6C7FBF8E
PPM, xrefs: 6C7FC0FD
truncated PPM data, xrefs: 6C7FBF5B
TRUNCATED, xrefs: 6C7FBF89
TRUNCATED, xrefs: 6C7FC0F8
IMAGE, xrefs: 6C7FBDDF
PPM image data has dimension(s) <= 0, xrefs: 6C7FBDA7
IMAGE, xrefs: 6C7FBF93
IMAGE, xrefs: 6C7FBD71
IMAGE, xrefs: 6C7FBE53
NO_HEADER, xrefs: 6C7FBD67

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: DIMENSIONS$IMAGE$IMAGE$IMAGE$IMAGE$IMAGE$INTENSITY$NO_HEADER$PPM$PPM$PPM$PPM$PPM$PPM image data has bad maximum intensity value %d$PPM image data has dimension(s) <= 0$TRUNCATED$TRUNCATED$couldn't read raw PPM header from string$truncated PPM data$truncated PPM data
API String ID: 0-1517778352
Opcode ID: 6d76d70d0d71be4a35d3107d6f7b538b7efa1f0d3505b93adb7aeaadaa9df3b8
Instruction ID: b770f6c6ac0f6d8f663ec81e71f1bf089e710678ae46d1fca5b9d44febb09ec7
Opcode Fuzzy Hash: 6d76d70d0d71be4a35d3107d6f7b538b7efa1f0d3505b93adb7aeaadaa9df3b8
Instruction Fuzzy Hash: 9BF12D71A001099FCB18DF98CE84ADEB7B5FF48318F148629E919B7750C735AA96CF90

Function 6C872C70 Relevance: 33.5, APIs: 5, Strings: 14, Instructions: 256windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6C872D8A
SendMessageW.USER32(?,0000040D,00000001,00000000), ref: 6C872E07
SendMessageW.USER32(?,0000040D,00000002,00000000), ref: 6C872E25

Strings

EMBED, xrefs: 6C872ED1
the window to use is not a Tk container, xrefs: 6C872E9E
window "%s" doesn't exist, xrefs: 6C872D9E
CONTAINER, xrefs: 6C872ECC
IN_USE, xrefs: 6C872E5F
Unable to get information of window "%.80s". Attach to thiswindow may have unpredictable results if it is not a valid container.Press Ok to proceed or Cancel to abort attaching., xrefs: 6C872F03
CANCEL, xrefs: 6C872F65
The container is already in use, xrefs: 6C872E31
EMBED, xrefs: 6C872F6A
EXIST, xrefs: 6C872DCC
Tk Warning, xrefs: 6C872F1A
Operation has been canceled, xrefs: 6C872F37
EMBED, xrefs: 6C872DD1
EMBED, xrefs: 6C872E64

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: MessageSend$Window
String ID: CANCEL$CONTAINER$EMBED$EMBED$EMBED$EMBED$EXIST$IN_USE$Operation has been canceled$The container is already in use$Tk Warning$Unable to get information of window "%.80s". Attach to thiswindow may have unpredictable results if it is not a valid container.Press Ok to proceed or Cancel to abort attaching.$the window to use is not a Tk container$window "%s" doesn't exist
API String ID: 2326795674-2446358716
Opcode ID: 994e4e815b6d2df1fc58522ef3c6b415dec09c871ead20df0c652d932bbaca7d
Instruction ID: 3db0019099afc1aa87cd9ebaea5e9a9d0803dda2f5b0936f3b01f8e877181ac3
Opcode Fuzzy Hash: 994e4e815b6d2df1fc58522ef3c6b415dec09c871ead20df0c652d932bbaca7d
Instruction Fuzzy Hash: 8DA18030B00208ABCB24CF58CD45FDD77B5EB49315F148AA8E919AB781D735AE82CB91

Function 6C7D1E90 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 74COMMON

Download Yara Rule

APIs

Tk_InternAtom.TK86T(?,MULTIPLE), ref: 6C7D1EA6

Part of subcall function 6C8560E0: XInternAtom.TK86T(?,6C81CB02,00000000,?,?,?,?,?,?,6C81CB02), ref: 6C856136

Tk_InternAtom.TK86T(?,INCR), ref: 6C7D1EC0
Tk_InternAtom.TK86T(?,TARGETS), ref: 6C7D1EDA
Tk_InternAtom.TK86T(?,TIMESTAMP), ref: 6C7D1EF4
Tk_InternAtom.TK86T(?,TEXT), ref: 6C7D1F0E
Tk_InternAtom.TK86T(?,COMPOUND_TEXT), ref: 6C7D1F28
Tk_InternAtom.TK86T(?,TK_APPLICATION), ref: 6C7D1F42
Tk_InternAtom.TK86T(?,TK_WINDOW), ref: 6C7D1F5C
Tk_InternAtom.TK86T(?,CLIPBOARD), ref: 6C7D1F76

Strings

TK_WINDOW, xrefs: 6C7D1F53
COMPOUND_TEXT, xrefs: 6C7D1F1F
CLIPBOARD, xrefs: 6C7D1F6D
INCR, xrefs: 6C7D1EB7
TIMESTAMP, xrefs: 6C7D1EEB
TEXT, xrefs: 6C7D1F05
TK_APPLICATION, xrefs: 6C7D1F39
TARGETS, xrefs: 6C7D1ED1
MULTIPLE, xrefs: 6C7D1E9D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: AtomIntern
String ID: CLIPBOARD$COMPOUND_TEXT$INCR$MULTIPLE$TARGETS$TEXT$TIMESTAMP$TK_APPLICATION$TK_WINDOW
API String ID: 3472945824-1141659008
Opcode ID: d3467acc029a916f711207ef95e30863bc4b8434606955463c308e901dd90143
Instruction ID: ddb58fe7cbc090e12c052b35f53561be5dba35c41e82cb11d6c24e1370c3f590
Opcode Fuzzy Hash: d3467acc029a916f711207ef95e30863bc4b8434606955463c308e901dd90143
Instruction Fuzzy Hash: ED31DDB9D00104AFC750DF90DA809FF7B75AB84248F64C978E9096F702E6329E56AB94

Function 6C873E90 Relevance: 27.3, APIs: 18, Instructions: 279COMMON

Download Yara Rule

APIs

TkWinGetDrawableDC.TK86T(?,00000000,?), ref: 6C873EC1
SetROP2.GDI32(?,00000000), ref: 6C873EDD
cos.MSVCR100 ref: 6C873FBA
sin.MSVCR100 ref: 6C873FF7

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Drawable
String ID:
API String ID: 117509128-0
Opcode ID: bf888960a1bdc91f6e567d30c2c39341ed4fd8efb212fcdc16a8ed196e436cdf
Instruction ID: 65f0c8a8a93c18f2ccfdbd835a04e501c18b22254727de559ce2f5d73ac3f69a
Opcode Fuzzy Hash: bf888960a1bdc91f6e567d30c2c39341ed4fd8efb212fcdc16a8ed196e436cdf
Instruction Fuzzy Hash: 80C11AB5A00609DFCB14CFA9D984ADEBBB5FF8D308F108528F509A3244EB349855CFA5

Function 6C7AAD80 Relevance: 27.2, APIs: 4, Strings: 14, Instructions: 204stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR100 ref: 6C7AADCF
strncmp.MSVCR100 ref: 6C7AAE6B

Strings

bad argument "%s": must be units or pages, xrefs: 6C7AAF70
units, xrefs: 6C7AAF4C
pages, xrefs: 6C7AAF15
option, xrefs: 6C7AAFFF
LOOKUP, xrefs: 6C7AB009
unknown option "%s": must be moveto or scroll, xrefs: 6C7AAFCD
INDEX, xrefs: 6C7AB004
scroll, xrefs: 6C7AAE62
SCROLL_UNITS, xrefs: 6C7AAF9E
moveto, xrefs: 6C7AADC6
TCL, xrefs: 6C7AB00E
scroll number units|pages, xrefs: 6C7AAE82
VALUE, xrefs: 6C7AAFA3
moveto fraction, xrefs: 6C7AADE2

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strncmp
String ID: INDEX$LOOKUP$SCROLL_UNITS$TCL$VALUE$bad argument "%s": must be units or pages$moveto$moveto fraction$option$pages$scroll$scroll number units|pages$units$unknown option "%s": must be moveto or scroll
API String ID: 1114863663-3258978467
Opcode ID: f87335ae1f59df532d2d61e49adeda2d219f7c7421ffbed9b568a8eb98d5f315
Instruction ID: fd873f08f50bbf8edf5da274fcbf3a6e865596ce99dc267a50b65bea82d04d6a
Opcode Fuzzy Hash: f87335ae1f59df532d2d61e49adeda2d219f7c7421ffbed9b568a8eb98d5f315
Instruction Fuzzy Hash: CD714074704244AFCB04CF98CD90EAB77B5EB89315F148678F9188B741D636EE92CB90

Function 6C84EED0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 271COMMON

Download Yara Rule

APIs

Tk_MakeWindowExist.TK86T(00000000), ref: 6C84EFEC
sprintf.MSVCR100 ref: 6C84F005
Tk_CreateWindow.TK86T(?,?,?,00000000), ref: 6C84F01C
Tk_MakeWindowExist.TK86T(?), ref: 6C84F04A
Tk_SetClass.TK86T(00000000,Busy), ref: 6C84F0C3
Tk_CreateOptionTable.TK86T(?,6C893018), ref: 6C84F0D4
Tk_InitOptions.TK86T(?,?,00000001,00000000), ref: 6C84F0F5
Tk_DestroyWindow.TK86T(00000000), ref: 6C84F105
Tk_MoveResizeWindow.TK86T(00000000,?,00000000,?,6C8BD0C0), ref: 6C84F170
Tk_CreateEventHandler.TK86T(00000000,00020000,Function_000CE880,?), ref: 6C84F18A
Tk_ManageGeometry.TK86T(00000000,6C8BD0AC,?), ref: 6C84F19F
Tk_DefineCursor.TK86T(00000000,00000000), ref: 6C84F1BB
Tk_CreateEventHandler.TK86T(?,00020000,Function_000CEBC0,?), ref: 6C84F1D5

Strings

Busy, xrefs: 6C84F0BA

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$Create$EventExistHandlerMake$ClassCursorDefineDestroyGeometryInitManageMoveOptionOptionsResizeTablesprintf
String ID: Busy
API String ID: 1538473417-1873282748
Opcode ID: 98f6c5275e66b17ac38acb422fc698e1f87d92c6ca35d4793521bc3a6ef06c64
Instruction ID: b9a482fb47ed5bedc9bd9d39708ad97f9fd54e9d0c69a22cc9b519b68355a60d
Opcode Fuzzy Hash: 98f6c5275e66b17ac38acb422fc698e1f87d92c6ca35d4793521bc3a6ef06c64
Instruction Fuzzy Hash: EEB1E3B5E00209AFCB04CF98D980DEEB7B5FF88314F148959E919AB741D731E945CBA0

Function 6C84CC00 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

Tk_FontId.TK86T(?), ref: 6C84CC1D
Tk_3DBorderColor.TK86T(?), ref: 6C84CC3A
Tk_GetGC.TK86T(?,0001400C,?), ref: 6C84CC63

Part of subcall function 6C811240: memset.MSVCR100 ref: 6C81127F

Tk_GetGC.TK86T(?,0000400C,?), ref: 6C84CDF4
Tk_FreeGC.TK86T(0001400C,00000000), ref: 6C84CC8B

Part of subcall function 6C811130: TkGetDisplay.TK86T(6C857F39,6C857741,6C857F39,?,?,?,6C857F39,00000000,?,00000000), ref: 6C81113A

Tk_3DBorderColor.TK86T(?), ref: 6C84CCBA
Tk_GetGC.TK86T(?,0000400C,?), ref: 6C84CCDC
Tk_FreeGC.TK86T(0000400C,00000000), ref: 6C84CD04
Tk_3DBorderColor.TK86T(?), ref: 6C84CD1F
Tk_GetBitmap.TK86T(00000000,?,gray50), ref: 6C84CD62
Tk_GetGC.TK86T(?,00000004,?), ref: 6C84CDAC
Tk_FreeGC.TK86T(0000400C,00000000), ref: 6C84CE1C

Part of subcall function 6C811130: XGContextFromGC.TK86T(?), ref: 6C8111D2
Part of subcall function 6C811130: Tk_FreeXId.TK86T(00000000,00000000), ref: 6C8111E2
Part of subcall function 6C811130: XFreeGC.TK86T(00000000), ref: 6C8111F7

Tk_GetGC.TK86T(?,00000000,?), ref: 6C84CE48

Strings

gray50, xrefs: 6C84CD55

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Free$BorderColorTk_3$BitmapContextDisplayFontFrommemset
String ID: gray50
API String ID: 87075780-2071141453
Opcode ID: f71ff2499cba7c3d0237ccbca0b48e4902db864006be059d64bd42d28f4d754d
Instruction ID: a3bf5712d1223e1d42933078f61f1684c9ce01669833d809bb6b207cec1a575d
Opcode Fuzzy Hash: f71ff2499cba7c3d0237ccbca0b48e4902db864006be059d64bd42d28f4d754d
Instruction Fuzzy Hash: BCA1D3B4E00208DFCB04CF98C984BDDF7B9BB89308F248669D919AF755D731A945CB90

Function 6C84DC20 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 388COMMON

Download Yara Rule

Strings

option ?arg ...?, xrefs: 6C84DC32
toggle, xrefs: 6C84E04D
deselect, xrefs: 6C84DDF2
flash, xrefs: 6C84DEB2
invoke, xrefs: 6C84DF9E
option, xrefs: 6C84DC61
cget option, xrefs: 6C84DCEA
select, xrefs: 6C84DFE5

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: cget option$deselect$flash$invoke$option$option ?arg ...?$select$toggle
API String ID: 0-2238337213
Opcode ID: 00772452a9d1a1fb723974da928595aca14b52027d2eb3d9a3a509df56436882
Instruction ID: 8dd3f42c263062a62f1b06a64a2c04ec99962c9a670e3618d73704b9df464573
Opcode Fuzzy Hash: 00772452a9d1a1fb723974da928595aca14b52027d2eb3d9a3a509df56436882
Instruction Fuzzy Hash: 85F14074A00209EFDB24CF98C980E9EB3B5FB89304F14C669F9259B751D771EA42CB91

Function 6C7B4DE0 Relevance: 22.9, APIs: 2, Strings: 13, Instructions: 412COMMON

Download Yara Rule

Strings

left, xrefs: 6C7B50C1
insert, xrefs: 6C7B51F2
mark option, xrefs: 6C7B4E1C
LOOKUP, xrefs: 6C7B5009
VALUE, xrefs: 6C7B5146
option ?arg ...?, xrefs: 6C7B4DEC
there is no mark named "%s", xrefs: 6C7B4FD2
TEXT_MARK, xrefs: 6C7B5004
current, xrefs: 6C7B5222
MARK_GRAVITY, xrefs: 6C7B5141
markName ?gravity?, xrefs: 6C7B4E78
bad mark gravity "%s": must be left or right, xrefs: 6C7B5113
right, xrefs: 6C7B50F0

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: LOOKUP$MARK_GRAVITY$TEXT_MARK$VALUE$bad mark gravity "%s": must be left or right$current$insert$left$mark option$markName ?gravity?$option ?arg ...?$right$there is no mark named "%s"
API String ID: 0-1423885126
Opcode ID: 2e7bb10370c44c39e632c7520ee27d6d3802798ab7f40800ab17b5b602b96667
Instruction ID: e5a3482387ca8011216b30232c56971eae468f7a1dcef00ce0f8070e4dc781a1
Opcode Fuzzy Hash: 2e7bb10370c44c39e632c7520ee27d6d3802798ab7f40800ab17b5b602b96667
Instruction Fuzzy Hash: 84027E70A04208DFCB04CF98DD84EDEB7B6FF49315F188668E819AB751D731A986CB90

Function 6C869C30 Relevance: 22.7, APIs: 15, Instructions: 168windowCOMMON

Download Yara Rule

APIs

TkWinGetDrawableDC.TK86T(00000002,00007FE3,?,?,?,?,?,?,?,?,?,?,6C86A9C2,?,?,?), ref: 6C869C42

Part of subcall function 6C873DB0: GetDC.USER32(00000000), ref: 6C873DD4
Part of subcall function 6C873DB0: TkWinSelectPalette.TK86T(?,?), ref: 6C873E6B
Part of subcall function 6C873DB0: GetBkMode.GDI32(?), ref: 6C873E7C

SetBkColor.GDI32(?,?), ref: 6C869C58
SetTextColor.GDI32(?,?), ref: 6C869C69
CreateCompatibleDC.GDI32(?), ref: 6C869C73
LoadBitmapW.USER32(00000000,?), ref: 6C869C83
SelectObject.GDI32(6C86A9C2,?), ref: 6C869C94
GetMapMode.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C86A9C2,?,?), ref: 6C869C9E
SetMapMode.GDI32(6C86A9C2,00000000), ref: 6C869CA9
GetObjectA.GDI32(?,00000018,?), ref: 6C869CB9
DPtoLP.GDI32(6C86A9C2,?,00000001), ref: 6C869CD5
DPtoLP.GDI32(6C86A9C2,00000000,00000001), ref: 6C869CF2
BitBlt.GDI32(?,00000000,00000002,?,?,6C86A9C2,00000000,00007FE3,00CC0020), ref: 6C869DC2
DeleteDC.GDI32(6C86A9C2), ref: 6C869DCC
DeleteObject.GDI32(?), ref: 6C869DD6
TkWinReleaseDrawableDC.TK86T(00007FE3,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C86A9C2), ref: 6C869DE8

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ModeObject$ColorDeleteDrawableSelect$BitmapCompatibleCreateLoadPaletteReleaseText
String ID:
API String ID: 2874253028-0
Opcode ID: 764da77e7eb705ea142e64b6575b5f7fff3c22e6cfdf7594ab65501641560f9e
Instruction ID: 6018817c9271a573d04354b758a41b86ef3911a749f142700070686d062094d5
Opcode Fuzzy Hash: 764da77e7eb705ea142e64b6575b5f7fff3c22e6cfdf7594ab65501641560f9e
Instruction Fuzzy Hash: 5E6118B5A0010AEFCB14CFA8D984EAEB7B5FF89305F148618F915A7744DB34E901CBA0

Function 6C7A4D80 Relevance: 22.6, APIs: 15, Instructions: 91windowCOMMON

Download Yara Rule

APIs

TkWinGetDrawableDC.TK86T(?,?,?), ref: 6C7A4D9B

Part of subcall function 6C873DB0: GetDC.USER32(00000000), ref: 6C873DD4
Part of subcall function 6C873DB0: TkWinSelectPalette.TK86T(?,?), ref: 6C873E6B
Part of subcall function 6C873DB0: GetBkMode.GDI32(?), ref: 6C873E7C

GetSysColorBrush.USER32(00000000), ref: 6C7A4DA8
SelectObject.GDI32(?,00000000), ref: 6C7A4DB3
GetSysColor.USER32(00000014), ref: 6C7A4DBE
GetSysColor.USER32(0000000F), ref: 6C7A4DC9
SetTextColor.GDI32(?,00000000), ref: 6C7A4DD4
SetBkColor.GDI32(?,?), ref: 6C7A4DE5
GetSysColor.USER32(00000000), ref: 6C7A4DF0
GetSysColor.USER32(0000000F), ref: 6C7A4DFA
SelectObject.GDI32(?), ref: 6C7A4E0E
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 6C7A4E2D
SetBkColor.GDI32(?,?), ref: 6C7A4E3B
SetTextColor.GDI32(?,?), ref: 6C7A4E49
SelectObject.GDI32(?,?), ref: 6C7A4E57
TkWinReleaseDrawableDC.TK86T(?,?,?), ref: 6C7A4E69

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Color$Select$Object$DrawableText$BrushModePaletteRelease
String ID:
API String ID: 1919212472-0
Opcode ID: 098e52cbe9ae518d5a53833986cdb4968543c24cf624cd46b68fa4697954e48f
Instruction ID: 64e3ff037318b145d3778970fae9b97f5c35ba016a0458c9ae0da15afe1da96d
Opcode Fuzzy Hash: 098e52cbe9ae518d5a53833986cdb4968543c24cf624cd46b68fa4697954e48f
Instruction Fuzzy Hash: AF31BAB6A01109AFCB54DFE8C984DEE77B9AF4D705F108569FA05E3640D631AD00CBB1

Function 6C86EDF0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

TkWinGetDrawableDC.TK86T(000000FF,?,6C806506), ref: 6C86EE3A
XCreateImage.TK86T(000000FF,00000000,00000020,6C806506,00000000,00000000,00000000,?,00000020,00000000), ref: 6C86EE61
memset.MSVCR100 ref: 6C86EEA1
GetPixel.GDI32(?,00000000,00000000), ref: 6C86EEEF
TkWinReleaseDrawableDC.TK86T(?,?,6C806506), ref: 6C86EF28

Strings

XGetImage Failure, xrefs: 6C86EFAC

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Drawable$CreateImagePixelReleasememset
String ID: XGetImage Failure
API String ID: 844865742-2254006489
Opcode ID: cfead259fb40c1f28a5578dda0e1ec6b22d05f8ac7bafc10138dc856a0608a2c
Instruction ID: 326d77ed33847d42f9114add54280d6fdc36d9c1a03d95d047074c6d2e28f5c1
Opcode Fuzzy Hash: cfead259fb40c1f28a5578dda0e1ec6b22d05f8ac7bafc10138dc856a0608a2c
Instruction Fuzzy Hash: 3DB1F3B5A00209AFDB14CF99C991FEEB7B5FF88304F108559E914AB780D735E941CBA1

Function 6C823CF0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

Tk_MainWindow.TK86T(?,00000000), ref: 6C823D44
Tk_CreateWindowFromPath.TK86T(?,00000000,00000000), ref: 6C823D51

Strings

Entry, xrefs: 6C823EE9
pathName ?-option value ...?, xrefs: 6C823CFC

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$CreateFromMainPath
String ID: Entry$pathName ?-option value ...?
API String ID: 636362913-1003886782
Opcode ID: 71ac5775ccf9884df949d7b6d9fb8a4690f91e1c3b6c3d5da664acf2b07c9caa
Instruction ID: e992aa8f849c8868af9f27fe3adc2f4d0e92d4366f326f426a5329219596c92a
Opcode Fuzzy Hash: 71ac5775ccf9884df949d7b6d9fb8a4690f91e1c3b6c3d5da664acf2b07c9caa
Instruction Fuzzy Hash: 1E912EB4A002059FDB14CF98CD94FAFB7B5FB88314F148A68E914AB341D776E941CBA0

Function 6C7D6EE0 Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 419COMMON

Download Yara Rule

APIs

Tk_CanvasPsY.TK86T(?), ref: 6C7D6F12

Part of subcall function 6C82D2F0: Tk_PostscriptY.TK86T(?,18488B08,6C7AE68D,?), ref: 6C82D310

Tk_CanvasPsY.TK86T(?), ref: 6C7D6F3A
Tk_CanvasPsColor.TK86T(?,?,00000000), ref: 6C7D7191
Tk_CanvasPsStipple.TK86T(?,?,00000000), ref: 6C7D7211
Tk_CanvasPsOutline.TK86T(?,?,?), ref: 6C7D72E7

Strings

0 setlinejoin 2 setlinecap, xrefs: 6C7D72AC
clip , xrefs: 6C7D71D9
grestore gsave, xrefs: 6C7D7255
fill, xrefs: 6C7D7270
matrix currentmatrix%.15g %.15g translate %.15g %.15g scale 1 0 moveto 0 0 1 0 360 arcsetmatrix, xrefs: 6C7D7030
%.15g %.15g moveto %.15g 0 rlineto 0 %.15g rlineto %.15g 0 rlineto closepath, xrefs: 6C7D6FB6

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Canvas$ColorOutlinePostscriptStipple
String ID: %.15g %.15g moveto %.15g 0 rlineto 0 %.15g rlineto %.15g 0 rlineto closepath$0 setlinejoin 2 setlinecap$clip $fill$grestore gsave$matrix currentmatrix%.15g %.15g translate %.15g %.15g scale 1 0 moveto 0 0 1 0 360 arcsetmatrix
API String ID: 2604417765-161327667
Opcode ID: 6c008abba5610a5a391479463c4d824c03b04bd5ea096897f003a62655c3d65d
Instruction ID: 2107f75143d00c138989ca9de443ef538d32902a8beb4f8a236bdff54c78fcca
Opcode Fuzzy Hash: 6c008abba5610a5a391479463c4d824c03b04bd5ea096897f003a62655c3d65d
Instruction Fuzzy Hash: 38020C74A10204DFCB04DF98D984A9DB7F1FF89314F2582B8E8199B754DB31AE86CB91

Function 6C838C50 Relevance: 19.7, APIs: 2, Strings: 9, Instructions: 418COMMON

Download Yara Rule

APIs

Tk_CanvasPsColor.TK86T(?,?,?), ref: 6C8390AF
Tk_CanvasPsStipple.TK86T(?,?,00000000), ref: 6C8390F5

Strings

StrokeClip , xrefs: 6C8390CA
%d, xrefs: 6C838E75
] 0 setdash, xrefs: 6C83908D
%d, xrefs: 6C83900D
%.15g setlinewidth, xrefs: 6C838D92
] %d setdash, xrefs: 6C838F28
] 0 setdash, xrefs: 6C839057
stroke, xrefs: 6C83910C
] %d setdash, xrefs: 6C839039

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Canvas$ColorStipple
String ID: %d$ %d$%.15g setlinewidth$StrokeClip $] %d setdash$] %d setdash$] 0 setdash$] 0 setdash$stroke
API String ID: 1671588389-1903114663
Opcode ID: a288bbaa3596d0091e38c1c73bded94113e4293715fdb9271e56d689b7aeb1d1
Instruction ID: 0e4673caba6868e51b702c8a83d28f56360bb5db2f3c41bd0d18b1f90e808f17
Opcode Fuzzy Hash: a288bbaa3596d0091e38c1c73bded94113e4293715fdb9271e56d689b7aeb1d1
Instruction Fuzzy Hash: 4E022D74E00219DFCB14CF98D980A9EB7B1FF89314F209669E819AB794D735AD42CF90

Function 6C81CEF0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

fabs.MSVCR100 ref: 6C81CF34
fabs.MSVCR100 ref: 6C81CF59
log10.MSVCR100 ref: 6C81CFAA
floor.MSVCR100 ref: 6C81CFB3
fabs.MSVCR100 ref: 6C81CFDD
log10.MSVCR100 ref: 6C81D00C
floor.MSVCR100 ref: 6C81D015

Strings

%%.%df, xrefs: 6C81D0BC
%%.%de, xrefs: 6C81D0DD

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: fabs$floorlog10
String ID: %%.%de$%%.%df
API String ID: 1796312857-2067013384
Opcode ID: 3eece2f9b3e547f49c65c8c31e1d2fd43e128056051ddb770e50692ce9bbdfe3
Instruction ID: 48c92f1f6b44dcea299619f9fb70af8252261d2d7763a99a875d12853bcd5763
Opcode Fuzzy Hash: 3eece2f9b3e547f49c65c8c31e1d2fd43e128056051ddb770e50692ce9bbdfe3
Instruction Fuzzy Hash: BE615870905209DFCB14DFA8CA887DDBBB1FF49308F148669E848AB741C7329A95CF95

Function 6C7E4CE0 Relevance: 18.4, APIs: 12, Instructions: 360COMMON

Download Yara Rule

APIs

__aligned_recalloc_base.LIBCMTD(00000000,?,?,?), ref: 6C7E4D41
Tk_Get3DBorderFromObj.TK86T(?,?), ref: 6C7E4D56
__aligned_recalloc_base.LIBCMTD(00000000,?,?,?), ref: 6C7E4D74
Tk_Fill3DRectangle.TK86T(?,?,00000002,?,?,?,?,00000000,00000000), ref: 6C7E4DBC
Tk_StrictMotif.TK86T ref: 6C7E4DCA
Tk_GetFontFromObj.TK86T(?,?), ref: 6C7E4DE2
Tk_GetFontMetrics.TK86T(?,?), ref: 6C7E4DF5
Tk_Fill3DRectangle.TK86T(?,00000000,00000002,?,?,?,?,00000000,00000000), ref: 6C7E4F62
Tk_Fill3DRectangle.TK86T(?,00000000,00000002,?,?,?,?,00000000,00000000), ref: 6C7E501C
Tk_Fill3DRectangle.TK86T(?,00000000,00000002,?,?,?,?,00000000,00000000), ref: 6C7E508C
Tk_GetReliefFromObj.TK86T(00000000,?,?), ref: 6C7E50A1
Tk_Draw3DRectangle.TK86T(?,00000000,00000002,00000000,00000000,?,?,?,?), ref: 6C7E50D4

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Rectangle$Fill3$From$Font__aligned_recalloc_base$BorderDraw3Get3MetricsMotifReliefStrict
String ID:
API String ID: 2021847862-0
Opcode ID: 426e16c4b8e5c09116635893adb33241ddd63e78b65ac2d5ba8eda612c68136a
Instruction ID: c774cffac7b658a42572e378b7c6487c7cf5d712d016410b3d7da760e0a6fd92
Opcode Fuzzy Hash: 426e16c4b8e5c09116635893adb33241ddd63e78b65ac2d5ba8eda612c68136a
Instruction Fuzzy Hash: 8BF18775A00109EFCB44CF98C695EAEB7F6BF8C304F248198E505AB355D731AE46CBA0

Function 6C825C90 Relevance: 18.2, APIs: 12, Instructions: 188windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

Tk_FreeColor.TK86T(?,?,?,?), ref: 6C825D18
Tk_FreeFont.TK86T(?,?,?,?,?), ref: 6C825D52
Tk_FreeStyle.TK86T(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C825D8C
Tk_FreeBitmap.TK86T(?,?,?,?,?,?,?), ref: 6C825DD0
Tk_Free3DBorder.TK86T(?,?,?,?,?,?,?,?), ref: 6C825E12
Tk_FreeCursor.TK86T(?,?,?,?,?,?,?,?,?,?), ref: 6C825E57

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Free$BitmapBorderColorCursorFontFree3Style
String ID:
API String ID: 3215748218-0
Opcode ID: 8eab1064dafdd32940eb9f9cd128be36449430152f1f919b11cae6bf7d5d3dfe
Instruction ID: 83d00b0a924d0f6784e45f55b136b5cbbd4ed6f9924ce07cffe5cffa59cffa1a
Opcode Fuzzy Hash: 8eab1064dafdd32940eb9f9cd128be36449430152f1f919b11cae6bf7d5d3dfe
Instruction Fuzzy Hash: 9E715FB8545349DFCB24CF58DA88B9A33B2BF45309F108969E8154B798D338EAD4CF91

Function 6C7AFEC0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

Tk_SetOptions.TK86T(?,?,?,00000000,?,?,00000000,00000000), ref: 6C7AFF28
Tk_DeleteEventHandler.TK86T(00000000,00020000,Function_0002FDE0,00000000), ref: 6C7AFF9B
Tk_ManageGeometry.TK86T(00000000,00000000,00000000), ref: 6C7AFFAB
Tk_UnmaintainGeometry.TK86T(00000000,?), ref: 6C7AFFCC
Tk_UnmapWindow.TK86T(00000000), ref: 6C7AFFDA
Tk_ManageGeometry.TK86T(00000000,6C889274,00000000), ref: 6C7B0175
Tk_CreateEventHandler.TK86T(00000000,00020000,Function_0002FDE0,00000000), ref: 6C7B0192

Strings

can't embed %s in %s, xrefs: 6C7B0055
GEOMETRY, xrefs: 6C7B008A
HIERARCHY, xrefs: 6C7B0085

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Geometry$EventHandlerManage$CreateDeleteOptionsUnmaintainUnmapWindow
String ID: GEOMETRY$HIERARCHY$can't embed %s in %s
API String ID: 738049382-3660221932
Opcode ID: 675fecbf334c832fe5218872015826c821d1fc363358137c91f2919e8cf98955
Instruction ID: 1d9cba979e91db34a3eecfa8e31bdda1bc28dbe06a1495a58180b900b9e9b35a
Opcode Fuzzy Hash: 675fecbf334c832fe5218872015826c821d1fc363358137c91f2919e8cf98955
Instruction Fuzzy Hash: F9B1DEB4A00209EFDB08CF94C991F9AB7B5FF48314F24C698E9199B755D731EA81CB90

Function 6C835DF0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 162COMMON

Download Yara Rule

Strings

COORDS, xrefs: 6C835FC4
WINDOW, xrefs: 6C835EFE
CANVAS, xrefs: 6C835FC9
wrong # coordinates: expected 2, got %d, xrefs: 6C835ED0
wrong # coordinates: expected 0 or 2, got %d, xrefs: 6C835F91
COORDS, xrefs: 6C835F03
CANVAS, xrefs: 6C835F08
WINDOW, xrefs: 6C835FBF

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: CANVAS$CANVAS$COORDS$COORDS$WINDOW$WINDOW$wrong # coordinates: expected 0 or 2, got %d$wrong # coordinates: expected 2, got %d
API String ID: 0-1088969367
Opcode ID: b6cee5281cb25d776e6cfe55f66354336e4b629efe8f1fe81b081d1dd89f4e32
Instruction ID: 4aceb9896ef556a01fba4cb6bbbd8d00bed0e8ce014f547d444bc2a598467de5
Opcode Fuzzy Hash: b6cee5281cb25d776e6cfe55f66354336e4b629efe8f1fe81b081d1dd89f4e32
Instruction Fuzzy Hash: 12516F74640204AFCB14DF58CE81E9A33B5EB89304F149A78F9089B751E731EE42DBE1

Function 6C7F5D10 Relevance: 16.8, APIs: 11, Instructions: 300COMMON

Download Yara Rule

APIs

TkClipBox.TK86T(?,00000000), ref: 6C7F5DB5
TkCreateRegion.TK86T ref: 6C7F5DF7
TkUnionRectWithRegion.TK86T(?,?,?), ref: 6C7F5E0B
TkIntersectRegion.TK86T(?,?,?), ref: 6C7F5E25
TkDestroyRegion.TK86T(?), ref: 6C7F5E31
TkClipBox.TK86T(?,00000000), ref: 6C7F5E44
memset.MSVCR100 ref: 6C7F5E8A
memset.MSVCR100 ref: 6C7F5EBF
memcpy.MSVCR100(?,?,?), ref: 6C7F5F1C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Region$Clipmemset$CreateDestroyIntersectRectUnionWithmemcpy
String ID:
API String ID: 3876938464-0
Opcode ID: 5953d300cbe9dda54940dc872c3ce5051e600aabb7bdff8736b7cba9cb2aae1c
Instruction ID: 565c4c8d95c20e8dca5be770a43f700cda6120d81461f2e942288191cb836bdd
Opcode Fuzzy Hash: 5953d300cbe9dda54940dc872c3ce5051e600aabb7bdff8736b7cba9cb2aae1c
Instruction Fuzzy Hash: 22D1F874A00219EFCB48CF99D5D4AEEB7B5FF48304F108569E9159B740E335EA86CB90

Function 6C7F3DB0 Relevance: 16.7, APIs: 11, Instructions: 184COMMON

Download Yara Rule

APIs

Tk_CreateErrorHandler.TK86T(?,000000FF,000000FF,000000FF,00000000,00000000), ref: 6C7F3E1C
XGetImage.TK86T(?,?,?,00000000,0000000F,?,000000FF,00000002), ref: 6C7F3E43
Tk_DeleteErrorHandler.TK86T(?), ref: 6C7F3E58
TkSetRegion.TK86T(?,?,?), ref: 6C7F3EE9
XSetClipOrigin.TK86T(?,?,?,?), ref: 6C7F3F0A
XCopyArea.TK86T(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C7F3F40

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ErrorHandler$AreaClipCopyCreateDeleteImageOriginRegion
String ID:
API String ID: 19598653-0
Opcode ID: 7e1c121be28d7c4f7bc91420b46e088590d7347ff04aaf5f1b0cddb8601369bc
Instruction ID: ca91e68c0795e42cf0dc5168549e8b6dcd7aa15a92bd5390b434b052843b081e
Opcode Fuzzy Hash: 7e1c121be28d7c4f7bc91420b46e088590d7347ff04aaf5f1b0cddb8601369bc
Instruction Fuzzy Hash: 4061D1B5A00108ABCB14DF9CDD81EDE77B9AF8C714F148618FA19A7391D731E911CBA1

Function 6C869E60 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 327windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00000000), ref: 6C869EBB
RemoveMenu.USER32(00000000,?,00000400), ref: 6C869EEA

Strings

.system, xrefs: 6C86A154

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Menu$CountItemRemove
String ID: .system
API String ID: 1046485675-2053189015
Opcode ID: 248e19538518b2d7cecae96f0fd73cbdf8a5ffeee67a39748da88ed9fc69efa6
Instruction ID: 89e998c30e9c804c324d3c34fde0c947be67a0e5f0c90a4d8f75c64703c2ebb7
Opcode Fuzzy Hash: 248e19538518b2d7cecae96f0fd73cbdf8a5ffeee67a39748da88ed9fc69efa6
Instruction Fuzzy Hash: 5FF1E874A00219CFCB24CF45C984BEEB7B2FB49308F2486A9D5196B795C775AE81CF90

Function 6C82BDC0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 223clipboardCOMMON

Download Yara Rule

APIs

Tk_ClipboardClear.TK86T(?,?), ref: 6C82BDEE

Part of subcall function 6C82BC70: TkClipInit.TK86T(?,?), ref: 6C82BC99

Tk_OwnSelection.TK86T(?,?,6C82B920,?), ref: 6C82BE21
Tk_CreateSelHandler.TK86T(?,?,?,6C82B9F0,00000000,?), ref: 6C82BEE2
Tk_GetAtomName.TK86T(?,?), ref: 6C82BF06

Part of subcall function 6C855FA0: Tk_CreateErrorHandler.TK86T(00000000,00000005,000000FF,000000FF,00000000,00000000), ref: 6C856004
Part of subcall function 6C855FA0: XGetAtomName.TK86T(00000000,6C85D962), ref: 6C856019
Part of subcall function 6C855FA0: Tk_DeleteErrorHandler.TK86T(6C85D962), ref: 6C85603B
Part of subcall function 6C855FA0: XFree.TK86T(00000000), ref: 6C856076

Tk_GetAtomName.TK86T(?,?,00000000), ref: 6C82BF1A
Tk_GetAtomName.TK86T(?,?,00000000,?,00000000), ref: 6C82BF2B

Strings

format "%s" does not match current format "%s" for %s, xrefs: 6C82BF34
FORMAT_MISMATCH, xrefs: 6C82BF62
CLIPBOARD, xrefs: 6C82BF67

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: AtomName$Handler$CreateError$ClearClipClipboardDeleteFreeInitSelection
String ID: CLIPBOARD$FORMAT_MISMATCH$format "%s" does not match current format "%s" for %s
API String ID: 3503036766-2768785289
Opcode ID: 600b6f4fe685afb9fa12fb5af5898d4a72985cf2c03b9423c04a004bcdab8622
Instruction ID: fa35d31513e0670c4616f4bbd5b1be3c511ed17bbfc949d9bfa512bc2bd1a31f
Opcode Fuzzy Hash: 600b6f4fe685afb9fa12fb5af5898d4a72985cf2c03b9423c04a004bcdab8622
Instruction Fuzzy Hash: 4FA1ED78A00209EFCB14CF98C984AEEBBB1FF48314F148599E809A7751D735AE81CF91

Function 6C840CC0 Relevance: 15.4, APIs: 10, Instructions: 383windowCOMMON

Download Yara Rule

APIs

Tk_SizeOfBitmap.TK86T(?,00000000,00000000,00000000), ref: 6C840E29
Tk_CanvasSetOffset.TK86T(00000000,00000000,?), ref: 6C840E99
Tk_ChangeOutlineGC.TK86T(00000000,?,?), ref: 6C840ECE
Tk_CanvasDrawableCoords.TK86T(00000000,?,?,?,?), ref: 6C840F41
XFillArc.TK86T(?,00000001,?,?,?,00000000,00000000,00000000,00005A00), ref: 6C840F8B
TkFillPolygon.TK86T(00000000,?,00000003,?,00000001,00000000,?), ref: 6C840FE1
XFillPolygon.TK86T(?,00000001,00000000,?,000000C8,00000000,00000000), ref: 6C8410B2
XDrawLines.TK86T(?,00000001,00000000,?,000000C8,00000000), ref: 6C8410DC
Tk_ResetOutlineGC.TK86T(00000000,?,?), ref: 6C841112
XSetTSOrigin.TK86T(?,00000000,00000000,00000000), ref: 6C84113E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Fill$CanvasOutlinePolygon$BitmapChangeCoordsDrawDrawableLinesOffsetOriginResetSize
String ID:
API String ID: 3988720704-0
Opcode ID: b7f114edc706281329a802c35a80d5919b470a1aab090767f3ffdd5301521e4d
Instruction ID: 716f5922333337a7ef9fa312d4964c2f175a4416b75bbd8bf7d56926218fd31b
Opcode Fuzzy Hash: b7f114edc706281329a802c35a80d5919b470a1aab090767f3ffdd5301521e4d
Instruction Fuzzy Hash: 8AF1C974A00109EFCB14CF98DA94FDEB7B6BF48304F2486A8E509AB755D731AE45CB90

Function 6C7D3E90 Relevance: 15.3, APIs: 10, Instructions: 304COMMON

Download Yara Rule

APIs

Tk_GetFontMetrics.TK86T(?,?), ref: 6C7D3EB2
Tk_GeometryRequest.TK86T(?,?,?), ref: 6C7D3FDC
Tk_SetInternalBorder.TK86T(?,?), ref: 6C7D3FF4
sprintf.MSVCR100 ref: 6C7D4022
Tk_TextWidth.TK86T(?,?,000000FF), ref: 6C7D403E
sprintf.MSVCR100 ref: 6C7D406A
Tk_TextWidth.TK86T(?,?,000000FF), ref: 6C7D4086
Tk_TextWidth.TK86T(?,?,00000000), ref: 6C7D4224
Tk_GeometryRequest.TK86T(?,?,?), ref: 6C7D4257
Tk_SetInternalBorder.TK86T(?,?), ref: 6C7D426F

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: TextWidth$BorderGeometryInternalRequestsprintf$FontMetrics
String ID:
API String ID: 351577729-0
Opcode ID: 48f41a0c43826f9e8efdbfc33dfb5b710b6744aee8cf834279c5516660d7a6d6
Instruction ID: a75f710069d765ac271bf63445d1eaf6766c0bc0416358b6b62a7d2cef2b3fe2
Opcode Fuzzy Hash: 48f41a0c43826f9e8efdbfc33dfb5b710b6744aee8cf834279c5516660d7a6d6
Instruction Fuzzy Hash: 47E1D474A00209EFCB04CF58C584FD9BBB2FF88354F1582A9E8499B756D731EA85CB80

Function 6C7DDD60 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 201stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR100 ref: 6C7DDDEF

Strings

LOOKUP, xrefs: 6C7DDE74
OPTION, xrefs: 6C7DDF6C
unknown option "%s", xrefs: 6C7DDEAF
LOOKUP, xrefs: 6C7DDEE6
LOOKUP, xrefs: 6C7DDF71
OPTION, xrefs: 6C7DDEE1
couldn't find synonym for option "%s", xrefs: 6C7DDF3A
ambiguous option "%s", xrefs: 6C7DDE3F
OPTION, xrefs: 6C7DDE6F

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strncmp
String ID: LOOKUP$LOOKUP$LOOKUP$OPTION$OPTION$OPTION$ambiguous option "%s"$couldn't find synonym for option "%s"$unknown option "%s"
API String ID: 1114863663-2563363807
Opcode ID: 589ef314d9776f7b7aea3d080bd7ffaeaed3263aa144bd012328c16972faab77
Instruction ID: 9b662718f6cc8983202aab48b906cbb2c0cce85a994774b8fbce1f27355a561f
Opcode Fuzzy Hash: 589ef314d9776f7b7aea3d080bd7ffaeaed3263aa144bd012328c16972faab77
Instruction Fuzzy Hash: 87812D34A00209EFCB14CF88C991E9EB7B6FB95304F1589A8E8149B755D730BE91CFA5

Function 6C858D50 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

ImmGetContext.IMM32(0000010F), ref: 6C858D75

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Context
String ID:
API String ID: 769703138-0
Opcode ID: 28ab69672a21c3a21f27f9e59cf711eb53758b20722e12dfacfd0ef991a37a22
Instruction ID: 707da3c710296a27a62482d4e56b056c3e0d70657857405a1183f961b203b6b5
Opcode Fuzzy Hash: 28ab69672a21c3a21f27f9e59cf711eb53758b20722e12dfacfd0ef991a37a22
Instruction Fuzzy Hash: DB5129B4E00208EFDB54CFA8C984BAEBBB1FF49304F208569E515AB351D734AA45CF91

Function 6C80FD70 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR100 ref: 6C80FDC2
strncmp.MSVCR100 ref: 6C80FDF2
strncmp.MSVCR100 ref: 6C80FE22

Strings

bad cap style "%s": must be butt, projecting, or round, xrefs: 6C80FE40
VALUE, xrefs: 6C80FE71
butt, xrefs: 6C80FDB9
round, xrefs: 6C80FE19
projecting, xrefs: 6C80FDE9
r, xrefs: 6C80FE0F
CAP, xrefs: 6C80FE6C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strncmp
String ID: CAP$VALUE$bad cap style "%s": must be butt, projecting, or round$butt$projecting$r$round
API String ID: 1114863663-636970930
Opcode ID: c4c82bdd767344b40f531a9279a63f79f325cfa10c4c4614f33c9d70d4e1f4c6
Instruction ID: 7958f1346dbae382fc134d50841a4b84f5c0109e0dc2135f66c9d6f1db0d0083
Opcode Fuzzy Hash: c4c82bdd767344b40f531a9279a63f79f325cfa10c4c4614f33c9d70d4e1f4c6
Instruction Fuzzy Hash: A1315074A04248AFCB24CF98CD45A9E77B5EF8A319F14C9A8E814AB701D7319A41CB94

Function 6C80FEE0 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR100 ref: 6C80FF32
strncmp.MSVCR100 ref: 6C80FF62
strncmp.MSVCR100 ref: 6C80FF92

Strings

round, xrefs: 6C80FF89
miter, xrefs: 6C80FF59
bad join style "%s": must be bevel, miter, or round, xrefs: 6C80FFB0
VALUE, xrefs: 6C80FFE1
JOIN, xrefs: 6C80FFDC
bevel, xrefs: 6C80FF29
r, xrefs: 6C80FF7F

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strncmp
String ID: JOIN$VALUE$bad join style "%s": must be bevel, miter, or round$bevel$miter$r$round
API String ID: 1114863663-1221465720
Opcode ID: 6ecd733bcbfe100d289f71c54cdba697cf91f6072b1ebfb3342e22345c953e8a
Instruction ID: ea4e05ed843feabe1a7e5873255d7fe8ddc88c2e422ba1bfc15426d5a0a708c0
Opcode Fuzzy Hash: 6ecd733bcbfe100d289f71c54cdba697cf91f6072b1ebfb3342e22345c953e8a
Instruction Fuzzy Hash: 3D317074A04249EFCF10CF98CD85A9E77B5EF8A304F14C9A8E818AB751D730AA00CF94

Function 6C7A3CF0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 158COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(00000114), ref: 6C7A3D14

Part of subcall function 6C7A3330: LoadLibraryW.KERNEL32(uxtheme.dll,?,?,?,?,?,?,?,?,6C7A3D26,?), ref: 6C7A333B
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 6C7A3372
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 6C7A3392
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 6C7A33B7
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 6C7A33DC
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 6C7A3401
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 6C7A3426
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 6C7A3447
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 6C7A3468
Part of subcall function 6C7A3330: GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 6C7A3489

Strings

xpnative, xrefs: 6C7A3D66
ttk::theme::xpnative, xrefs: 6C7A3EDA
winnative, xrefs: 6C7A3D4E
8.6, xrefs: 6C7A3ED5
Scale.trough, xrefs: 6C7A3EB1
vsapi, xrefs: 6C7A3DE7
vista, xrefs: 6C7A3E0E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: 8.6$Scale.trough$ttk::theme::xpnative$vista$vsapi$winnative$xpnative
API String ID: 1968650500-3722483149
Opcode ID: 4996eacc118049a832baa795037127ff1388936878dff18399f598c99928b112
Instruction ID: 4a141be1cafd7f46d0a25283da14d290b635d9319877d9136cafa032c311960b
Opcode Fuzzy Hash: 4996eacc118049a832baa795037127ff1388936878dff18399f598c99928b112
Instruction Fuzzy Hash: 535153B5E00108ABCB14DFD4DE85EEEB7B5EB49304F1085A8E509A7740D735EB85CB90

Function 6C801F80 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 415COMMON

Download Yara Rule

APIs

memset.MSVCR100 ref: 6C801FAF

Part of subcall function 6C801A40: memset.MSVCR100 ref: 6C801A6C

Strings

too many colors, xrefs: 6C802111
IMAGE, xrefs: 6C802147
GIF, xrefs: 6C802142
COLORFUL, xrefs: 6C80213D
;, xrefs: 6C802483
GIF87a, xrefs: 6C80205D, 6C80206F
GIF89a, xrefs: 6C802051

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: memset
String ID: ;$COLORFUL$GIF$GIF87a$GIF89a$IMAGE$too many colors
API String ID: 2221118986-2790153539
Opcode ID: 64df919279200b8acdcda425d2279da33319116fdbdef147a9d57286579c9358
Instruction ID: dc14a4c1569a9ba35f75f6d564304300bd45f278477a57f6f7ba7a7cbe28133d
Opcode Fuzzy Hash: 64df919279200b8acdcda425d2279da33319116fdbdef147a9d57286579c9358
Instruction Fuzzy Hash: 3E025075A042499FCF14CF98CC85BEEBBB6EF88304F048558E908AB341D7759B54CB95

Function 6C79CD70 Relevance: 12.2, APIs: 8, Instructions: 194COMMON

Download Yara Rule

APIs

Tk_Get3DBorderFromObj.TK86T(00000000,00000000), ref: 6C79CD9C
__aligned_recalloc_base.LIBCMTD(00000000,00000000,00000002,00000002), ref: 6C79CDCC
Tk_GetReliefFromObj.TK86T(00000000,?,00000002), ref: 6C79CDE1
Tk_Fill3DRectangle.TK86T(00000000,00000002,00000000,00000002,?,?,?,00000002,00000002), ref: 6C79CE0D

Part of subcall function 6C858110: XFillRectangle.TK86T(?,?,?,?,?,?,?), ref: 6C85819A
Part of subcall function 6C858110: Tk_Draw3DRectangle.TK86T(?,?,?,?,?,?,?,00000000,00000000), ref: 6C8581CC

Tk_3DBorderGC.TK86T(00000000,00000000,00000002,00000000,00000002,00000000,00000002), ref: 6C79CEA8
Tk_3DBorderGC.TK86T(00000000,00000000,00000003,-00000001,00000002,-00000001,00000002), ref: 6C79CE6A

Part of subcall function 6C883580: XDrawLines.TK86T(?,00000000,00000002,?,00000002,00000000), ref: 6C8835BA

Tk_3DBorderGC.TK86T(00000000,00000000,00000003,00000002,?,00000002,?), ref: 6C79CF09
Tk_3DBorderGC.TK86T(00000000,00000000,00000002,00000002,?,00000002,?), ref: 6C79CF47

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Border$Tk_3$Rectangle$From$DrawDraw3FillFill3Get3LinesRelief__aligned_recalloc_base
String ID:
API String ID: 148425790-0
Opcode ID: 400f00dd3df8275862e1294c67382715b0bcaa8ae281926c5e380c5e5fd9e400
Instruction ID: 944c8b6fa5cf7c3a0ac85f6dea595680380aaa8f2bb0b2b529f74dff1708ec3c
Opcode Fuzzy Hash: 400f00dd3df8275862e1294c67382715b0bcaa8ae281926c5e380c5e5fd9e400
Instruction Fuzzy Hash: C771DBB291010AAFCB44CF98DD81EEF77B9BF88308F148618F91897345D675E925CBA1

Function 6C81FC10 Relevance: 12.2, APIs: 8, Instructions: 168COMMON

Download Yara Rule

APIs

Tk_TextWidth.TK86T(?,6C8B71AC,00000001), ref: 6C81FC3E

Part of subcall function 6C818100: Tk_MeasureChars.TK86T(6C8AA638,00000000,00000000,000000FF,00000000,00000001), ref: 6C818150

Tk_SetBackgroundFromBorder.TK86T(?,?), ref: 6C81FD0D
Tk_FontId.TK86T(?), ref: 6C81FD24
Tk_GetGC.TK86T(?,00014004,?), ref: 6C81FD4B
Tk_FreeGC.TK86T(?,00000000), ref: 6C81FD73
Tk_FontId.TK86T(?), ref: 6C81FDA8
Tk_GetGC.TK86T(?,00004004,?), ref: 6C81FDC8
Tk_FreeGC.TK86T(?,00000000), ref: 6C81FDF0

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: FontFree$BackgroundBorderCharsFromMeasureTextWidth
String ID:
API String ID: 3680827187-0
Opcode ID: b0a90f5cc4bfe880703d66c528907afde5ce886969a00097637900887edda386
Instruction ID: aaef0fe2858d1de1c97056cf8c6a8c250980791933da97a125cb8e9f14d1ddb4
Opcode Fuzzy Hash: b0a90f5cc4bfe880703d66c528907afde5ce886969a00097637900887edda386
Instruction Fuzzy Hash: F27192B4E04109DFDB24CFA8D584B9DF7B1BB48308F24866ED829AB752D731A945CF90

Function 6C846E90 Relevance: 12.2, APIs: 8, Instructions: 153COMMON

Download Yara Rule

APIs

Tk_CanvasTkwin.TK86T(?), ref: 6C846EA0
Tk_ConfigureWidget.TK86T(?,?,6C8910F0,?,?,?,?), ref: 6C846ECE
Tk_GetImage.TK86T(?,?,00000000,Function_000C6DC0,?), ref: 6C846F2E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: CanvasConfigureImageTkwinWidget
String ID:
API String ID: 2979845629-0
Opcode ID: d1c5702410870aa496b04f9c6bd43505d249ca428a1b4776f2f46de8ed52b3be
Instruction ID: 55ac4235dac7de4f382f2a5be2e02f60bc83bd87bd97cb5073ba57e4ba456ff0
Opcode Fuzzy Hash: d1c5702410870aa496b04f9c6bd43505d249ca428a1b4776f2f46de8ed52b3be
Instruction Fuzzy Hash: C75119B5A0020CEFDB14DF98C984B9EB7B5FB48309F1089A8E9159B741D735EA85CF90

Function 6C86ADA0 Relevance: 11.0, APIs: 7, Instructions: 457COMMON

Download Yara Rule

APIs

__aligned_recalloc_base.LIBCMTD(?,?,?,?), ref: 6C86ADDC
Tk_GetFontFromObj.TK86T(00000000,?), ref: 6C86AE17
Tk_GetFontMetrics.TK86T(?,?), ref: 6C86AE2A
Tk_TextWidth.TK86T(?,6C8C2DD4,00000001), ref: 6C86AE3D
__aligned_recalloc_base.LIBCMTD(?,00000000,?,?), ref: 6C86AE60

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Font__aligned_recalloc_base$FromMetricsTextWidth
String ID:
API String ID: 2156043739-0
Opcode ID: abfb15d59e822ebbf6ab58a0b60f377329e88b5464ac651966acc2742c53f018
Instruction ID: b26965ee2a641fd2c389595ce56a4bf074eabfad0360908f8944e68d7170d3c0
Opcode Fuzzy Hash: abfb15d59e822ebbf6ab58a0b60f377329e88b5464ac651966acc2742c53f018
Instruction Fuzzy Hash: 34326578E00209DFCB18CF88D590DAEBBB2FF88314F248559E915AB755D731A986CF90

Function 6C81FE40 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 417COMMON

Download Yara Rule

APIs

fabs.MSVCR100 ref: 6C81FEBB

Strings

%lf, xrefs: 6C8201F1
(in command executed by spinbox), xrefs: 6C820483

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: fabs
String ID: (in command executed by spinbox)$%lf
API String ID: 3906731895-336300982
Opcode ID: 3a88f7d2341b53bbd8d0e370939c799a09899c3e485b2a7764299b6d85a5798f
Instruction ID: fa3e4882ce50243273abb6e4aaf5011722214d5619c146425d8a9afc17bb6a1c
Opcode Fuzzy Hash: 3a88f7d2341b53bbd8d0e370939c799a09899c3e485b2a7764299b6d85a5798f
Instruction Fuzzy Hash: EB120374A00118DFCB24CF08C998BD9B7B1FB89314F1486E9E95DAB741D735AA85CF80

Function 6C7EFEA0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

Tk_SetOptions.TK86T(?,?,?,?,?,?,?,00000000), ref: 6C7EFF5C
Tk_RestoreSavedOptions.TK86T(?), ref: 6C7EFFA1
Tk_SetBackgroundFromBorder.TK86T(?,?), ref: 6C7EFFB6
Tk_OwnSelection.TK86T(?,00000001,Function_0006FD00,?), ref: 6C7F0015

Strings

: invalid -listvariable value, xrefs: 6C7F00F0

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Options$BackgroundBorderFromRestoreSavedSelection
String ID: : invalid -listvariable value
API String ID: 2068023440-435395121
Opcode ID: 5fc926e32314f806442b10a80c525e1f61b9b67916acfc4f27ab2403744ededc
Instruction ID: 2328092c95245bb5959037f30a9fcdf2f4fe08fc7b7040a5419262928297c9f5
Opcode Fuzzy Hash: 5fc926e32314f806442b10a80c525e1f61b9b67916acfc4f27ab2403744ededc
Instruction Fuzzy Hash: AFD1E575600208EFDB54CF58C984BDAB3B5FB89314F1482A9E9199B791D731EE82CF90

Function 6C810CF0 Relevance: 10.7, APIs: 7, Instructions: 243COMMON

Download Yara Rule

APIs

Tk_MapWindow.TK86T(?), ref: 6C810D38
Tk_CreateEventHandler.TK86T(00000000,00020000,6C8103F0,00000000), ref: 6C810E64
Tk_CreateEventHandler.TK86T(00000000,00020000,6C810A70,?), ref: 6C810EA1
Tk_MoveResizeWindow.TK86T(?,?,?,?,?), ref: 6C810D1E

Part of subcall function 6C7A7040: XMoveResizeWindow.TK86T(?,00000000,?,?,00000000,?), ref: 6C7A7094
Part of subcall function 6C7A7040: TkDoConfigureNotify.TK86T(?), ref: 6C7A70A0

Tk_MoveResizeWindow.TK86T(00000000,?,00000000,00000000,00000001), ref: 6C810F64
Tk_MapWindow.TK86T(00000000), ref: 6C810F78
Tk_UnmapWindow.TK86T ref: 6C810F88

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$MoveResize$CreateEventHandler$ConfigureNotifyUnmap
String ID:
API String ID: 2425551680-0
Opcode ID: 10e98bc3bd4973cd0a916eb6a6de90af4639ba9bc1571854ba848ebc5879eb48
Instruction ID: 0bf6b3555974f3fd250b0538c625d989376924477bc7e7e0f81ab1ca6b8761ec
Opcode Fuzzy Hash: 10e98bc3bd4973cd0a916eb6a6de90af4639ba9bc1571854ba848ebc5879eb48
Instruction Fuzzy Hash: 4AB1DBB4A0420ADFCB04CF84C991EAEBBB1FF88314F148599E915ABB55D731E991CF90

Function 6C7C8E90 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

TkTextMakeByteIndex.TK86T(?,?,00000000,00000000,?), ref: 6C7C8ED1
TkBTreeNumLines.TK86T(?,?,00000000,?), ref: 6C7C8F08
TkTextMakeByteIndex.TK86T(?,?,00000000), ref: 6C7C8F1E

Strings

TextFetchSelection couldn't find end of range, xrefs: 6C7C8FD4

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ByteIndexMakeText$LinesTree
String ID: TextFetchSelection couldn't find end of range
API String ID: 3921965626-3623953540
Opcode ID: e17663b919c6ddbe40dd1b149493e5a58e0c070422d88b31c0561b5009933abb
Instruction ID: cb9179c72ec2e5cf8d95437ef82bf24d2e4af2e27d2decaeaeea5665e0d09d82
Opcode Fuzzy Hash: e17663b919c6ddbe40dd1b149493e5a58e0c070422d88b31c0561b5009933abb
Instruction Fuzzy Hash: 7C910A75E01209EFDB04CF98EA94F9EB7B6BF48308F148269E805A7741E731E945CB52

Function 6C809D60 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 198COMMON

Download Yara Rule

Strings

%d is an invalid value: should NOT be < 0, xrefs: 6C809E4E
NEG_INDEX, xrefs: 6C809E7C
window ?-option value ...?, xrefs: 6C809D8D
option, xrefs: 6C809DDA
GRID, xrefs: 6C809E81

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: %d is an invalid value: should NOT be < 0$GRID$NEG_INDEX$option$window ?-option value ...?
API String ID: 0-3117744265
Opcode ID: 716f78b0595ca04f8801515ddc65ddb0c995f99f26966eb37aa799fb48df6d3b
Instruction ID: 14b4fc7cf6ae5e70720d1543083c579db134e7a81e092b8cc9b8a116dfc104a1
Opcode Fuzzy Hash: 716f78b0595ca04f8801515ddc65ddb0c995f99f26966eb37aa799fb48df6d3b
Instruction Fuzzy Hash: 84811E74B04109DFDB14CF88CE80E9EB3B5EB49314F148A68E914AB791D775EE41CB91

Function 6C7DFE30 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

VALUE, xrefs: 6C7DFF30
DISTANCE, xrefs: 6C7DFF2B
bad screen distance "%s", xrefs: 6C7DFEFD
p, xrefs: 6C7DFF8B

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: DISTANCE$VALUE$bad screen distance "%s"$p
API String ID: 0-3712703321
Opcode ID: 9867317a6dd1f39a3bff7f077e79ca0643dd431f65ad26fa64b5b18b644b0617
Instruction ID: 10ecab89edf24e4952f89a68c5230a4c73ab5f744b9793200b5305486eeef83a
Opcode Fuzzy Hash: 9867317a6dd1f39a3bff7f077e79ca0643dd431f65ad26fa64b5b18b644b0617
Instruction Fuzzy Hash: 81710E74A04209DFCB04CF98C990A9EB7B1FF89314F24C669E819AB751C735EA42CF91

Function 6C819D90 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

printf.MSVCR100 ref: 6C819E2A
printf.MSVCR100 ref: 6C819F72

Strings

focus cleared after %s died, xrefs: 6C819F6D
releasing focus to root after %s died, xrefs: 6C819E25
forwarding focus to %s after %s died, xrefs: 6C819F0C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: printf
String ID: focus cleared after %s died$forwarding focus to %s after %s died$releasing focus to root after %s died
API String ID: 3524737521-3504952018
Opcode ID: ceaa20589623a0022f16ea8eeb746386b942a0e6b811f8e78e45f8f071420690
Instruction ID: 8c0912d0ec572e6990be6e97cc648fcdb1cf522c46133b466b8b7f8be86c0e90
Opcode Fuzzy Hash: ceaa20589623a0022f16ea8eeb746386b942a0e6b811f8e78e45f8f071420690
Instruction Fuzzy Hash: C1718774A0420AEFDB14CF44C594A9DBBB2FF49318F248699E8095BB55C731EE86CF90

Function 6C86DE00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000400), ref: 6C86DEDA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C7EBD45,000000FF,?,?), ref: 6C86DF1F
IsDebuggerPresent.KERNEL32 ref: 6C86DF49
OutputDebugStringW.KERNEL32(?), ref: 6C86DF80
MessageBoxW.USER32(00000000,?,?,00051030), ref: 6C86DFAD

Strings

..., xrefs: 6C86DF2D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ByteCharMultiWide$DebugDebuggerMessageOutputPresentString
String ID: ...
API String ID: 2081025636-1685331755
Opcode ID: a44dd778a9ff56d66cbc3068030a5db9a0ff360bf542237cbb35a476b30058b9
Instruction ID: 1019f966cddc6cab9fc6abca951b51196c7501f8ca600119432acac253c6de3b
Opcode Fuzzy Hash: a44dd778a9ff56d66cbc3068030a5db9a0ff360bf542237cbb35a476b30058b9
Instruction Fuzzy Hash: 1D415774B00208ABCB24DF58CD40BDA73B9FF49310F10C6B9A9599B690DA709E86CF91

Function 6C828D20 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

?newName?, xrefs: 6C828DAF
appname not accessible in a safe interpreter, xrefs: 6C828D47
SAFE, xrefs: 6C828D7A
APPLICATION, xrefs: 6C828D75

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: ?newName?$APPLICATION$SAFE$appname not accessible in a safe interpreter
API String ID: 0-596591569
Opcode ID: f9d726ad09d73300b0f73d77ea0ff181b895a8913b10264b33d4d4c80ff017ab
Instruction ID: 44dbd92f0208d5d2dd541794a7109ef577e0373ae9d956a264772dacba620c87
Opcode Fuzzy Hash: f9d726ad09d73300b0f73d77ea0ff181b895a8913b10264b33d4d4c80ff017ab
Instruction Fuzzy Hash: 3F317C75A00204AFCB14DF58CD85E9A73B5EB48324F148778F8189B750D735EE82CB91

Function 6C871CD0 Relevance: 9.4, APIs: 6, Instructions: 381COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDC.USER32(?), ref: 6C871D16
SelectObject.GDI32(?,475F6B54), ref: 6C871D3F

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-0
Opcode ID: 8a219b27d00903a49b88d6b06e6952fb3004ee819ac51f7926020c68c75aaa6a
Instruction ID: 355f07af54116c7adfb4997d50f54ce3b183ff8dc5b92fd699f42ee9b7b41070
Opcode Fuzzy Hash: 8a219b27d00903a49b88d6b06e6952fb3004ee819ac51f7926020c68c75aaa6a
Instruction Fuzzy Hash: F202A575A00119DFCB28CF88C995ADEB7B5FF48304F148699E919A7740D774AE81CFA0

Function 6C7E1E60 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

Tk_GetPixmap.TK86T(?,?,?,?,?), ref: 6C7E1EEF
Tk_Fill3DRectangle.TK86T(?,?,?,00000000,00000000,?,?,?,?), ref: 6C7E1F29
Tk_Fill3DRectangle.TK86T(?,?,?,?,?,00000000,00000000,00000001,?), ref: 6C7E1FEF

Part of subcall function 6C858110: XFillRectangle.TK86T(?,?,?,?,?,?,?), ref: 6C85819A
Part of subcall function 6C858110: Tk_Draw3DRectangle.TK86T(?,?,?,?,?,?,?,00000000,00000000), ref: 6C8581CC

Tk_Fill3DRectangle.TK86T(?,?,?,?,?,00000002,00000002,00000001,00000002), ref: 6C7E202F
XCopyArea.TK86T(?,?,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6C7E206A
Tk_FreePixmap.TK86T(?,?), ref: 6C7E207C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Rectangle$Fill3$Pixmap$AreaCopyDraw3FillFree
String ID:
API String ID: 3476433401-0
Opcode ID: 89912a9deb4d49c553337391b0dcb8ebdba5e508985094e9b1b58c57bdf9c3d7
Instruction ID: 07c79804e4e334caaf839c84b2d52eaef4367db293581d08746dca43139fb0dd
Opcode Fuzzy Hash: 89912a9deb4d49c553337391b0dcb8ebdba5e508985094e9b1b58c57bdf9c3d7
Instruction Fuzzy Hash: 61919CB5A00109EFCB48CF98C991EAEB7B5BF8C304F248698E515AB795D731ED41CB90

Function 6C79EE20 Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

Tk_Get3DBorderFromObj.TK86T(?,?), ref: 6C79EE3F
Tk_GetColorFromObj.TK86T(?,?), ref: 6C79EE55
Tk_GetColorFromObj.TK86T(?,?), ref: 6C79EE6B
Tk_GetReliefFromObj.TK86T(00000000,?,00000002), ref: 6C79EE91
Tk_Fill3DRectangle.TK86T(?,?,?,00000002,?,00000002,?,00000000,00000000), ref: 6C79EEB9

Part of subcall function 6C858110: XFillRectangle.TK86T(?,?,?,?,?,?,?), ref: 6C85819A
Part of subcall function 6C858110: Tk_Draw3DRectangle.TK86T(?,?,?,?,?,?,?,00000000,00000000), ref: 6C8581CC

Part of subcall function 6C79EA90: Tk_GCForColor.TK86T(?,?), ref: 6C79EA9E
Part of subcall function 6C79EA90: Tk_Draw3DRectangle.TK86T(?,00000002,?,?,?,?,?,?,?), ref: 6C79EC5D

Tk_GCForColor.TK86T(?,?), ref: 6C79EF56

Part of subcall function 6C827A60: XCreateGC.TK86T(?,46140277,00000004,?), ref: 6C827ABA

Part of subcall function 6C79E200: XFillPolygon.TK86T(00000001,?,?,?,00000003,00000002,00000000), ref: 6C79E252
Part of subcall function 6C79E200: XDrawLines.TK86T(00000001,?,?,?,00000004,00000000), ref: 6C79E26E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ColorFromRectangle$Draw3Fill$BorderCreateDrawFill3Get3LinesPolygonRelief
String ID:
API String ID: 920517266-0
Opcode ID: 5c4320cb0688cb4f375d51fba5b2ed8bf5d730481eed747f377cfa0c7b36da61
Instruction ID: 63213ee3238213c5343933aa46dcde56057d1784b66d0182afdf96b20a70fee8
Opcode Fuzzy Hash: 5c4320cb0688cb4f375d51fba5b2ed8bf5d730481eed747f377cfa0c7b36da61
Instruction Fuzzy Hash: EE51E4B5A002099FCB04CF98E985DABB7F9BB8C304F14C659F91997351D634E851CBA0

Function 6C7BDE50 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 6C7BE0AE
, xrefs: 6C7BE0B5
(vertical scrolling command executed by text), xrefs: 6C7BE1C3

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: (vertical scrolling command executed by text)$ $
API String ID: 0-1028888951
Opcode ID: e1f53d7f11b016af620f0a1be65c519a1a9c9173ad75d55b04f364919d065d2d
Instruction ID: bfa3fbeb4a9561c53d377b1affcb8eaf78340419964152b756568cf7f7f7868f
Opcode Fuzzy Hash: e1f53d7f11b016af620f0a1be65c519a1a9c9173ad75d55b04f364919d065d2d
Instruction Fuzzy Hash: 84C12C74A10208DFCB04DF98C984BDEB7B1FF89314F1482A8E819A7355DB35AA95CF91

Function 6C7E6C80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155stringCOMMON

Download Yara Rule

APIs

strtol.MSVCR100 ref: 6C7E6CA5
__aligned_recalloc_base.LIBCMTD(00000000,?,?,?,?,?,?,?,?,?,?,?,6C7E712B,00000000,?,00000000), ref: 6C7E6CD3
strtol.MSVCR100 ref: 6C7E6CFF

Strings

+q~l, xrefs: 6C7E6DE4, 6C7E6E0F, 6C7E6D8A, 6C7E6E29, 6C7E6DB5, 6C7E6E26, 6C7E6DCD, 6C7E6D78, 6C7E6E03, 6C7E6DA9
+q~l, xrefs: 6C7E6D20

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strtol$__aligned_recalloc_base
String ID: +q~l$+q~l
API String ID: 3987521396-2798593822
Opcode ID: e5cfafa8213121c8af1a8da8b2e48a149349e2cb3c4a517eb5d0f9e0b1a63817
Instruction ID: 9a88194bf7cbacc4272eb67c5cea49cca10bed7631c52f41c69f023b2c901114
Opcode Fuzzy Hash: e5cfafa8213121c8af1a8da8b2e48a149349e2cb3c4a517eb5d0f9e0b1a63817
Instruction Fuzzy Hash: 2E71B575A00109DFCB04CF88C5919AEB7B6FF89304F248699E915AB745D731AA41CFA1

Function 6C803EB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

isspace.MSVCR100 ref: 6C803EEF
isspace.MSVCR100 ref: 6C803F2F
isspace.MSVCR100 ref: 6C803FC0

Strings

,, xrefs: 6C80400B

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: isspace
String ID: ,
API String ID: 3785662208-3772416878
Opcode ID: b633a43476530fc3b9b2496cca71fce0bec67fe01a3388d714ef9f7384899c5f
Instruction ID: f79033a4e1693dca5aa90b9f3048dd5a20d3a283885562a5a7e509737053a8fd
Opcode Fuzzy Hash: b633a43476530fc3b9b2496cca71fce0bec67fe01a3388d714ef9f7384899c5f
Instruction Fuzzy Hash: F0518274F04208EFCB14CF68C990A9D7BB1EF86309F1486A9E8559BB51D731DE81CB81

Function 6C859F80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000004E,?,?), ref: 6C85A0D8

Strings

G, xrefs: 6C859FCA

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: MessageSend
String ID: G
API String ID: 3850602802-985283518
Opcode ID: f0d967b51950bcfce31743c56023aa76b748da4b0772b0071f92066e9c4cf2fb
Instruction ID: 24ef1de72bbb12c7c5cd415dbcfe6ede38e25f4c76b86ad120155e3cd6dcc948
Opcode Fuzzy Hash: f0d967b51950bcfce31743c56023aa76b748da4b0772b0071f92066e9c4cf2fb
Instruction Fuzzy Hash: F1516270D44208EFDB61CF98C9D0AFE77B5EB45305F80C869E91597A40D3B89A60CF61

Function 6C795E70 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

Wrong #elements in padding spec, xrefs: 6C795EB8
TTK, xrefs: 6C795EEE
VALUE, xrefs: 6C795EE9
PADDING, xrefs: 6C795EE4

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID: PADDING$TTK$VALUE$Wrong #elements in padding spec
API String ID: 0-1464939598
Opcode ID: 532fe15313343c526aca5906bf8a5d4d76151da1f7b4e60dd3fe933747ec7f7f
Instruction ID: 40f62328bb3d41139f2f85446cf83387f2e9e5f7d3e369000d7552855e305d50
Opcode Fuzzy Hash: 532fe15313343c526aca5906bf8a5d4d76151da1f7b4e60dd3fe933747ec7f7f
Instruction Fuzzy Hash: C3418475600108EBCB44CF98EE84EDE73F6EF48315F148668E81A97750E731EA45CBA1

Function 6C781E80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Tk_GetGC.TK86T(?,00010001,00000003), ref: 6C781EAB

Part of subcall function 6C811240: memset.MSVCR100 ref: 6C81127F

XCopyArea.TK86T(?,c!xl,?,?,00000000,00000000,?,?,00000000,00000000), ref: 6C781EE1

Part of subcall function 6C874FC0: TkWinGetDrawableDC.TK86T(?,?,?,F4458B52,?,?,6C7F609B,?,?,?), ref: 6C874FDB
Part of subcall function 6C874FC0: TkWinGetDrawableDC.TK86T(?,6C7F609B,?,?,?,?,F4458B52,?,?,6C7F609B,?,?,?), ref: 6C874FFA
Part of subcall function 6C874FC0: SelectClipRgn.GDI32(F4458B52,?), ref: 6C875026
Part of subcall function 6C874FC0: OffsetClipRgn.GDI32(F4458B52,?,?,?,?,?,F4458B52), ref: 6C87503E
Part of subcall function 6C874FC0: BitBlt.GDI32(F4458B52,?,?,?,?,?,00000000,F4458B52,?), ref: 6C875071
Part of subcall function 6C874FC0: SelectClipRgn.GDI32(F4458B52,00000000), ref: 6C87507D
Part of subcall function 6C874FC0: TkWinReleaseDrawableDC.TK86T(6C7F609B,F4458B52,?,?,?,?,F4458B52), ref: 6C875097
Part of subcall function 6C874FC0: TkWinReleaseDrawableDC.TK86T(?,?,?,?,?,?,F4458B52), ref: 6C8750AB

Tk_FreePixmap.TK86T(?,c!xl), ref: 6C781EF3

Part of subcall function 6C8687B0: DeleteObject.GDI32(?), ref: 6C8687D6

Tk_FreeGC.TK86T(?,?), ref: 6C781F05

Part of subcall function 6C811130: TkGetDisplay.TK86T(6C857F39,6C857741,6C857F39,?,?,?,6C857F39,00000000,?,00000000), ref: 6C81113A

Strings

c!xl, xrefs: 6C781ED7, 6C781EE9, 6C781EDA, 6C781EEC

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Drawable$Clip$FreeReleaseSelect$AreaCopyDeleteDisplayObjectOffsetPixmapmemset
String ID: c!xl
API String ID: 3639922778-2461693355
Opcode ID: 9eb0613f11943706f40bc5ada301fa6a47736a24b0b64bd69fee31fd47b45f31
Instruction ID: 165459723d80bdd236b0b0ee271dffce754ac2bda7581b9a287ec74ab447390e
Opcode Fuzzy Hash: 9eb0613f11943706f40bc5ada301fa6a47736a24b0b64bd69fee31fd47b45f31
Instruction Fuzzy Hash: BC112E75A00208AFCB00CF98DD91FAE77B9AB88748F108058F9099F340D731E945CB90

Function 6C7C9EC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCR100 ref: 6C7C9ED8
Tk_GetUid.TK86T(Selection), ref: 6C7C9F1B
Tk_HandleEvent.TK86T(00000023), ref: 6C7C9F2A

Strings

#, xrefs: 6C7C9EE0
Selection, xrefs: 6C7C9F16

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: EventHandlememset
String ID: #$Selection
API String ID: 2730301545-3222430026
Opcode ID: 30cc1cbb3bf22873d45cbc8b8cb688497fc0ae2f6228178a4ce2ef47f8b926d3
Instruction ID: f7aeff4fe2fa65f087e67337f02a2ac82d94e38e3b8bcddcf7ae036d597261e0
Opcode Fuzzy Hash: 30cc1cbb3bf22873d45cbc8b8cb688497fc0ae2f6228178a4ce2ef47f8b926d3
Instruction Fuzzy Hash: C0014CB4E003089FDB04CF98D995A9DBBB1FF48304F104469E90A5F341DB31E994CB91

Function 6C870D70 Relevance: 7.7, APIs: 5, Instructions: 238COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fcad07eb2a7a198eaf7deb7d1af8e059089d112dfb41adb2ae7aa0d9869d6e
Instruction ID: 1ed6ac57add7834978650247ab4c61e871a232edf6c3782dcc40c1f6cda2a7da
Opcode Fuzzy Hash: 11fcad07eb2a7a198eaf7deb7d1af8e059089d112dfb41adb2ae7aa0d9869d6e
Instruction Fuzzy Hash: FDB1E675A04248DFCB24CF58CA90BDEB7B1BF49304F1485A9E919AB741D735AE81CFA0

Function 6C7AFC00 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22354d9ff466b914cce2e33fbd62ddc5db6b20eda243400a549eb2463585364
Instruction ID: d2be0836f0c99a93acc958447ff38bc225a4ed3115bba397a911f4e11f91d46e
Opcode Fuzzy Hash: c22354d9ff466b914cce2e33fbd62ddc5db6b20eda243400a549eb2463585364
Instruction Fuzzy Hash: CA51C6B5A00109EFCB04CFC9DA90DAEB7B5AF48304F248658E919AB755D731EE42CB90

Function 6C804E00 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

Tk_FreeColor.TK86T(00000000), ref: 6C804E36
Tk_FreeColor.TK86T(?), ref: 6C804E4E
Tk_FreePixmap.TK86T(00000000,00000000), ref: 6C804E6A
Tk_FreePixmap.TK86T(00000000,?), ref: 6C804E86
Tk_FreeGC.TK86T(00000000,00000000), ref: 6C804EA2

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Free$ColorPixmap
String ID:
API String ID: 3271364703-0
Opcode ID: aadd64b04394e5b3a242b9f69432723f04844ab5adf1e5152b43c8e6d0747546
Instruction ID: 832c1a66b65e822c48c2f0173a6cfef29b12dacb3f42b02959e081c4950e6ba5
Opcode Fuzzy Hash: aadd64b04394e5b3a242b9f69432723f04844ab5adf1e5152b43c8e6d0747546
Instruction Fuzzy Hash: 5B41B678A40108EFCB14CF98DA80A9DB7B2BF99314F608698D8095B755D731EE86DF90

Function 6C79EC70 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

Tk_Get3DBorderFromObj.TK86T(?,?), ref: 6C79EC87
Tk_GetColorFromObj.TK86T(?,?), ref: 6C79EC9D
__aligned_recalloc_base.LIBCMTD(00000000,?,00000002,00000002), ref: 6C79ECC7
Tk_GetReliefFromObj.TK86T(00000000,?,00000002), ref: 6C79ECDC
Tk_Fill3DRectangle.TK86T(?,00000002,?,00000002,?,?,?,00000002,00000000), ref: 6C79ED06

Part of subcall function 6C858110: XFillRectangle.TK86T(?,?,?,?,?,?,?), ref: 6C85819A
Part of subcall function 6C858110: Tk_Draw3DRectangle.TK86T(?,?,?,?,?,?,?,00000000,00000000), ref: 6C8581CC

Part of subcall function 6C79EA90: Tk_GCForColor.TK86T(?,?), ref: 6C79EA9E
Part of subcall function 6C79EA90: Tk_Draw3DRectangle.TK86T(?,00000002,?,?,?,?,?,?,?), ref: 6C79EC5D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Rectangle$From$ColorDraw3$BorderFillFill3Get3Relief__aligned_recalloc_base
String ID:
API String ID: 2815707858-0
Opcode ID: ab855fb7b0964b326b369f6377b8cf31d3f92548f11c3e99215d1d4572ddcf13
Instruction ID: 71554289eecffc7463460b6e6b5cc220c5c7e62a5c9ebb9844d564a2a82cba24
Opcode Fuzzy Hash: ab855fb7b0964b326b369f6377b8cf31d3f92548f11c3e99215d1d4572ddcf13
Instruction Fuzzy Hash: FC31CDB5A10209AFCB44CF98D985DAFB7B9BF4C304F148558FA18A7351E730E951CBA1

Function 6C86FE40 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

SelectObject.GDI32(6C8176C6,FFFEC485), ref: 6C86FE5C
SelectObject.GDI32(6C8176C6,08558B51), ref: 6C86FE89

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-0
Opcode ID: 6e507fdfb151f915389b4f72e298f1a95dbdf205e089616993e3545c91037353
Instruction ID: 4529dd9b863142fb99a77d8c15684b3da2e86a9ce09384f0418cfb06e8c5b070
Opcode Fuzzy Hash: 6e507fdfb151f915389b4f72e298f1a95dbdf205e089616993e3545c91037353
Instruction Fuzzy Hash: 093129B820424ADFCB14CF59D588E9A7BB5BF89314F01CA58F9198B745C734E865CFA0

Function 6C873DB0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 6C873DD4
CreateCompatibleDC.GDI32(00000000), ref: 6C873E40
SelectObject.GDI32(?,00000000), ref: 6C873E54
TkWinSelectPalette.TK86T(?,?), ref: 6C873E6B
GetBkMode.GDI32(?), ref: 6C873E7C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Select$CompatibleCreateModeObjectPalette
String ID:
API String ID: 2197431397-0
Opcode ID: 377ce62de61e486b0c77f6badf1ee3a9c1f4c4d5378329c90c6dfc13a1422a80
Instruction ID: 3cd839695c58ad5212532de73f673665b20bf734bcbf2b517398cff2b7107db9
Opcode Fuzzy Hash: 377ce62de61e486b0c77f6badf1ee3a9c1f4c4d5378329c90c6dfc13a1422a80
Instruction Fuzzy Hash: 7631DC79A00209EFCB54CF98C58499DBBB2FF89314F24C6A9E9199B741D731AE41CF90

Function 6C84EDA0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

Tk_DeleteEventHandler.TK86T(?,00020000,Function_000CEBC0,?), ref: 6C84EDE0
Tk_FreeConfigOptions.TK86T(00000000,?,00000000), ref: 6C84EE03
Tk_DeleteEventHandler.TK86T(00000000,00020000,Function_000CE880,?), ref: 6C84EE20
Tk_ManageGeometry.TK86T(00000000,00000000,?), ref: 6C84EE35
Tk_DestroyWindow.TK86T(00000000), ref: 6C84EE44

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: DeleteEventHandler$ConfigDestroyFreeGeometryManageOptionsWindow
String ID:
API String ID: 398754454-0
Opcode ID: 0727c49ab31824b274051c400912b16eac900390e7da641d0960d7bf041f4667
Instruction ID: 26f06099f4109b578a6d14b0de671537d656bd25a98fee39efe5a6d19c26404c
Opcode Fuzzy Hash: 0727c49ab31824b274051c400912b16eac900390e7da641d0960d7bf041f4667
Instruction Fuzzy Hash: 732103B9A00108EFDB04DF94D991EAAB3B5EB88304F2485A8E9095B751D731EF42DBD0

Function 6C7C3D80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

TkBTreeNumLines.TK86T(00000000,00000000), ref: 6C7C3E92
TkBTreeNumLines.TK86T(00000000,00000000), ref: 6C7C3EC3

Strings

TkBTreeLinesTo couldn't find line, xrefs: 6C7C3DB7
TkBTreeLinesTo couldn't find node, xrefs: 6C7C3E15

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: LinesTree
String ID: TkBTreeLinesTo couldn't find line$TkBTreeLinesTo couldn't find node
API String ID: 444678813-1035875499
Opcode ID: cd1cff255e37dc50d9b81aac0e417a7c65ca388c048cbc5ace9c63b1de19bfc9
Instruction ID: 0026c54e7e27f4f3d3b5fd22c43c1ca292710cec1db3b7f490362a563548d1bf
Opcode Fuzzy Hash: cd1cff255e37dc50d9b81aac0e417a7c65ca388c048cbc5ace9c63b1de19bfc9
Instruction Fuzzy Hash: 3151C778E0020AEFCB04CF94C585AEEBBB1FB49308F248599D9156B750D735AA45CF92

Function 6C844E60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

Tk_CanvasPsPath.TK86T(?,?,?,00000006), ref: 6C844EF5
Tk_CanvasPsStipple.TK86T(?,?,00000000), ref: 6C844F64

Strings

fill, xrefs: 6C844FA4
clip , xrefs: 6C844F2E

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Canvas$PathStipple
String ID: clip $fill
API String ID: 3334823470-1584838765
Opcode ID: d0d570fc961b5c5211c25d84b28d9f4667327bfffd1f466cad3d840a55227e5f
Instruction ID: 0b31bf4abded74ae167d7c5abd09d1668ac6cc7cc9222f17a21ecdb8e0bd212a
Opcode Fuzzy Hash: d0d570fc961b5c5211c25d84b28d9f4667327bfffd1f466cad3d840a55227e5f
Instruction Fuzzy Hash: 8141F875600209EFDB18CF48C985EDA73B5EF89324F14C668E8198B3A0D735EA95CB91

Function 6C7BCCD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

TkBTreeNumLines.TK86T(00000000,?,?,?,6C7B757E,00000000,?,00000000), ref: 6C7BCCE3
TkTextIndexForwBytes.TK86T(?,00000000,?,~u{l), ref: 6C7BCD61

Part of subcall function 6C7BB250: TkTextPrintIndex.TK86T(00000000,00000000,?), ref: 6C7BB288

Strings

~u{l, xrefs: 6C7BCD4E, 6C7BCD8A, 6C7BCD51
~u{l, xrefs: 6C7BCD24, 6C7BCD45, 6C7BCDAB

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: IndexText$BytesForwLinesPrintTree
String ID: ~u{l$~u{l
API String ID: 1753727603-3470106995
Opcode ID: f1f233d4f1521f569a8b1c5ad4ce11039346d9e8c94ee12b423425eea14b2857
Instruction ID: 17c68b6c16d3e807aa8a3f6e2dddadc509aac6305c03e23f585663d1dfb1c6bb
Opcode Fuzzy Hash: f1f233d4f1521f569a8b1c5ad4ce11039346d9e8c94ee12b423425eea14b2857
Instruction Fuzzy Hash: D43101B9A00209AFCB04DF98D995EAEB7B5FF48304F14C548F918AB345D731EA41CBA1

Function 6C861E80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

Tk_HWNDToWindow.TK86T ref: 6C861EA2
SendMessageW.USER32(00000000,00000404,000000FF,000000FF), ref: 6C861EFE
_TkWinChildProc@16.TK86T(?,00000046,?,?), ref: 6C861F80

Strings

F, xrefs: 6C861E8C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ChildMessageProc@16SendWindow
String ID: F
API String ID: 1419096988-1304234792
Opcode ID: 2c45c9f7a9b6ba5c6c6ea26a8437f14540068572a0f4dca25004c00b2f3e4a08
Instruction ID: 9417c0bdb3aee3ced4b37ad60b64aa86b6494c46deb5a086690781343130c72c
Opcode Fuzzy Hash: 2c45c9f7a9b6ba5c6c6ea26a8437f14540068572a0f4dca25004c00b2f3e4a08
Instruction Fuzzy Hash: 94310CB4A04209EFCB54CF99C68099EB7B1FF48314F2486A8E9199B781D731EE51CF90

Function 6C7ABE90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

memset.MSVCR100 ref: 6C7ABEA8
Tk_GetUid.TK86T(?), ref: 6C7ABEE1
Tk_QueueWindowEvent.TK86T(00000023,00000000), ref: 6C7ABEF2

Part of subcall function 6C81BA10: TkGetDisplayList.TK86T(?,?,00000000,?), ref: 6C81BA18

Strings

#, xrefs: 6C7ABEB0

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: DisplayEventListQueueWindowmemset
String ID: #
API String ID: 869124156-1885708031
Opcode ID: 064c76eea17e7aa6210bd3c23b7ae2694f28747b49236f1a627aaa23e2e70f6e
Instruction ID: 9a70b83603a8f43929cb8dc4f9835acfc01805012a6bbd302a6acab2f8b0e1aa
Opcode Fuzzy Hash: 064c76eea17e7aa6210bd3c23b7ae2694f28747b49236f1a627aaa23e2e70f6e
Instruction Fuzzy Hash: B9010CB4E0030CAFDB04CF98D995BADBBB5EF48304F504069E9099F340EB31AA54CB91

Function 6C843E00 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b1c809496a4a306119bf4ead6e172f30acdce79ce9a52ad660dabf1d0336ce
Instruction ID: ca0bfa7b32b3bb9b4ab9e808f311a15d7e24435bd32979405dfff266ec678563
Opcode Fuzzy Hash: a7b1c809496a4a306119bf4ead6e172f30acdce79ce9a52ad660dabf1d0336ce
Instruction Fuzzy Hash: 50B1E774A0020DDFDB14CF84DA84FAEB7B1BB88304F2486A9D5096B785C731AE95DF91

Function 6C7E2EE0 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

Tk_DeleteEventHandler.TK86T(?,00020000,Function_00062DE0,?), ref: 6C7E2F8F
Tk_ManageGeometry.TK86T(?,00000000,00000000), ref: 6C7E2FAA
Tk_FreeConfigOptions.TK86T(?,?), ref: 6C7E2FCC
Tk_FreeConfigOptions.TK86T(?,?), ref: 6C7E3051

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ConfigFreeOptions$DeleteEventGeometryHandlerManage
String ID:
API String ID: 3150854907-0
Opcode ID: 6d68b3417606565ac213bf1a8d768cd70db94482ac1c4de547f411449e78a50b
Instruction ID: 40f7deeb58988c029b2d1c9dd162a28682cea7c607a160b22ae3f526cc2d3b04
Opcode Fuzzy Hash: 6d68b3417606565ac213bf1a8d768cd70db94482ac1c4de547f411449e78a50b
Instruction Fuzzy Hash: 6151CA79600205EFDB08CF54D991E9A77B6FB89354F1482A8E8598F365CB31EE81DBC0

Function 6C882E10 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

TkPositionInTree.TK86T(00000000,00000000), ref: 6C882E77
TkPositionInTree.TK86T(?,00000000), ref: 6C882E8A
Tk_QueueWindowEvent.TK86T(?,00000000), ref: 6C882F0B
TkInOutEvents.TK86T(?,00000000,00000000,00000008,00000007,00000000), ref: 6C882F8B

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: PositionTree$EventEventsQueueWindow
String ID:
API String ID: 2074718703-0
Opcode ID: 3b0b5ec2d7256a7bbfeaece6784c21daf1a7f7444e9a253f3cbc72ca52203be7
Instruction ID: c03adebb7b953895afc59489edfed0e6e394c912d8b0498b46c07b3b0fbce8a1
Opcode Fuzzy Hash: 3b0b5ec2d7256a7bbfeaece6784c21daf1a7f7444e9a253f3cbc72ca52203be7
Instruction Fuzzy Hash: 5D513F75E01209DFDB24CF84C984BEEB7B5BF48304F108599E519A7B41D734AA44CFA1

Function 6C7D3D30 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Tk_FreeGC.TK86T(?,00000000), ref: 6C7D3DFD
Tk_FreeGC.TK86T(?,?), ref: 6C7D3E22
Tk_FreeGC.TK86T(?,00000000), ref: 6C7D3E47
Tk_FreeConfigOptions.TK86T(?,?,?), ref: 6C7D3E60

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Free$ConfigOptions
String ID:
API String ID: 2849719307-0
Opcode ID: 73b0843ed49a8f57f8b727e8675585fb5d65c5371591324525436b6be3a4ca82
Instruction ID: 8345ab4e92c1a6f32bc40de2b62212a2e74852bfa77b06ca682e5a1c042df5ec
Opcode Fuzzy Hash: 73b0843ed49a8f57f8b727e8675585fb5d65c5371591324525436b6be3a4ca82
Instruction Fuzzy Hash: 4F410C79A10104EFCB04CB94DA80F9EB3F6EB88304F2582B8E5086B755D731AF42DB90

Function 6C867ED0 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32(00000000,00000000,00000001,00000001), ref: 6C867EDE
SetRectRgn.GDI32(?,00000000,00000000,?,00000001), ref: 6C867FA4
CombineRgn.GDI32(?,?,?,00000002), ref: 6C867FB8
DeleteObject.GDI32(?), ref: 6C867FD5

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Rect$CombineCreateDeleteObject
String ID:
API String ID: 1043552210-0
Opcode ID: e30611cf053aa5f96488a943e532efdfffa4a64ab538a7c2c87e9ad3f869e319
Instruction ID: b2375260a809e4e8f388c1528a52ad64300ee0aaef89a654bafb3fe66427c6ba
Opcode Fuzzy Hash: e30611cf053aa5f96488a943e532efdfffa4a64ab538a7c2c87e9ad3f869e319
Instruction Fuzzy Hash: 2741C474A0410AEFCF14CF89C990EAEB7B2BF49304F148A99F915A7A45D730AA50CF95

Function 6C79ED50 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Tk_Get3DBorderFromObj.TK86T(?,?), ref: 6C79ED67
Tk_GetColorFromObj.TK86T(?,?), ref: 6C79ED7D
Tk_GetReliefFromObj.TK86T(00000000,00000002,00000002), ref: 6C79EDA3
Tk_Fill3DRectangle.TK86T(?,00000002,?,00000002,?,?,?,00000000,00000000), ref: 6C79EDCB

Part of subcall function 6C858110: XFillRectangle.TK86T(?,?,?,?,?,?,?), ref: 6C85819A
Part of subcall function 6C858110: Tk_Draw3DRectangle.TK86T(?,?,?,?,?,?,?,00000000,00000000), ref: 6C8581CC

Part of subcall function 6C79EA90: Tk_GCForColor.TK86T(?,?), ref: 6C79EA9E
Part of subcall function 6C79EA90: Tk_Draw3DRectangle.TK86T(?,00000002,?,?,?,?,?,?,?), ref: 6C79EC5D

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Rectangle$From$ColorDraw3$BorderFillFill3Get3Relief
String ID:
API String ID: 3643325756-0
Opcode ID: 7bc550b0ce3018043d06472df58ac5a432cdc691711a76dc664ff3e3ef8bfc45
Instruction ID: 7797702131e4651f877f072e986e1d593b9ca352bec8e1c65a164ac8b2a6f014
Opcode Fuzzy Hash: 7bc550b0ce3018043d06472df58ac5a432cdc691711a76dc664ff3e3ef8bfc45
Instruction Fuzzy Hash: 1421CCB5A00109ABCB44CF99D981EEFB7F9BF4C204F148559FA18A7341E731E952CBA1

Function 6C803CB0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR100 ref: 6C803CF6
strncmp.MSVCR100 ref: 6C803D0E

Strings

GIF89a, xrefs: 6C803D09
GIF87a, xrefs: 6C803CF1

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: strncmp
String ID: GIF87a$GIF89a
API String ID: 1114863663-2918331024
Opcode ID: 2b3c82895c944cfe8c4ccc30d4945ec70f3d2276f09d94cfae58f9124d82df50
Instruction ID: 6241be3c7cb13de388e623957beed66e4d4d53ddd72b04171f0ed5dc3f523a57
Opcode Fuzzy Hash: 2b3c82895c944cfe8c4ccc30d4945ec70f3d2276f09d94cfae58f9124d82df50
Instruction Fuzzy Hash: F821FCB5A00108ABDB14CF99DD81EEF77B9AB4C304F108558F918A7741E735E914CBA1

Function 6C861C30 Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON

Download Yara Rule

APIs

TkpWmSetState.TK86T(6C8732DF,00000002,?,?,6C8732DF,00000000), ref: 6C861CA8
TkpWmSetState.TK86T(6C8732DF,00000001,?,?,6C8732DF,00000000), ref: 6C861CB8
TkWmRestackToplevel.TK86T(6C8732DF,00000000,00000000,6C8732DF,00000000), ref: 6C861CD8
TkSetFocusWin.TK86T(6C8732DF,00000001), ref: 6C861CF2

Part of subcall function 6C85AD70: IsIconic.USER32(FFFFFF7B), ref: 6C85ADB7
Part of subcall function 6C85AD70: IsZoomed.USER32(FFFFFF7B), ref: 6C85ADC8

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: State$FocusIconicRestackToplevelZoomed
String ID:
API String ID: 3997672839-0
Opcode ID: 1b821cfdc5909309529d357f4968c5fb8b961a56a6a4a9f31e8e412ebb157c48
Instruction ID: 64228161e91409781169aa3fa40249c7fba3ab0987654d174148626b40cd7e29
Opcode Fuzzy Hash: 1b821cfdc5909309529d357f4968c5fb8b961a56a6a4a9f31e8e412ebb157c48
Instruction Fuzzy Hash: D9219275A00204EBC720CF45DA81FED3375AB84309F258574E8095FB86DB32EE95DB80

Function 6C79CCE0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Tk_Get3DBorderFromObj.TK86T(?,?), ref: 6C79CCF7
__aligned_recalloc_base.LIBCMTD(00000000,00000002,00000002,00000002), ref: 6C79CD21
Tk_GetReliefFromObj.TK86T(00000000,?,00000002), ref: 6C79CD36
Tk_Fill3DRectangle.TK86T(00000002,00000002,?,?,?,?,?,00000002,00000002), ref: 6C79CD62

Part of subcall function 6C858110: XFillRectangle.TK86T(?,?,?,?,?,?,?), ref: 6C85819A
Part of subcall function 6C858110: Tk_Draw3DRectangle.TK86T(?,?,?,?,?,?,?,00000000,00000000), ref: 6C8581CC

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Rectangle$From$BorderDraw3FillFill3Get3Relief__aligned_recalloc_base
String ID:
API String ID: 4262063756-0
Opcode ID: f197fbb124b5c48829dbfa518d5b6af94768a6d6dfaa3b3c9521f78e676bfd06
Instruction ID: 514fed74e136713c0ea6ca36e45c8f17d4431c1dee055520f9d71e95d5ce39ce
Opcode Fuzzy Hash: f197fbb124b5c48829dbfa518d5b6af94768a6d6dfaa3b3c9521f78e676bfd06
Instruction Fuzzy Hash: 0B112BB2A10109AFCB44CFC8D981EAFB7B9BF4C204F048558FA1897341E770E910CBA1

Function 6C85AD30 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 6C85AD35
GetSystemMetrics.USER32(0000004D), ref: 6C85AD42
GetSystemMetrics.USER32(0000004E), ref: 6C85AD4F
GetSystemMetrics.USER32(0000004F), ref: 6C85AD5C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: e1e0aae8cc2f8573b7ec56468a3d51284ee266a8d999e70df96f40c9e3b468c3
Instruction ID: d1cb17fb6e34841f58b3da4cd3823e051b808ba4557c46cb65f337d0ec39654b
Opcode Fuzzy Hash: e1e0aae8cc2f8573b7ec56468a3d51284ee266a8d999e70df96f40c9e3b468c3
Instruction Fuzzy Hash: DAE01AB9241306DFEB409F64C90AA2ABB70FF4B724F008062FE098F780D7705804CBA9

Function 6C7B1D80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

memcpy.MSVCR100(00000000,00000000,?), ref: 6C7B1FE7
TkTextSetMark.TK86T(00000000,current,?), ref: 6C7B2165

Part of subcall function 6C7B1A50: Tk_BindEvent.TK86T(00000000,00000007,?,0000000A,?), ref: 6C7B1AE6

Strings

current, xrefs: 6C7B215C

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: BindEventMarkTextmemcpy
String ID: current
API String ID: 1053772904-3706926091
Opcode ID: 3cbd13f8790fbefd0f089788d110ec40fc0dc6a83c1702d007f7d3ee58b5f490
Instruction ID: 766e114f3abce22f4e939acc32faacc37ae3e9c42b9182f323598a000f3073b2
Opcode Fuzzy Hash: 3cbd13f8790fbefd0f089788d110ec40fc0dc6a83c1702d007f7d3ee58b5f490
Instruction Fuzzy Hash: 48F1C575A01208EFCB04CF58C994BD9B7B1FB88354F14C2A9E919AB751C735EA85CF90

Function 6C83AE70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

Tk_CanvasGetTextInfo.TK86T(?), ref: 6C83AE99
Tk_CanvasTkwin.TK86T(?), ref: 6C83B0D7

Strings

canvas did not pass any coords, xrefs: 6C83AE82

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Canvas$InfoTextTkwin
String ID: canvas did not pass any coords
API String ID: 3036948247-4046525298
Opcode ID: c6840e56328aaf1d27087579e0389c1ff22230f5da41d3864ac20237cf8f1a53
Instruction ID: 521bb43e97094d5019eb52fcead412583f3830b8d3f0a6ca17011afd1082425d
Opcode Fuzzy Hash: c6840e56328aaf1d27087579e0389c1ff22230f5da41d3864ac20237cf8f1a53
Instruction Fuzzy Hash: 2D71EDB4A00209DFDB04CF94C594B9EBBB5BF44318F1496A8D8585F381C776AA85CF90

Function 6C844CA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Tk_CreateOutline.TK86T(?), ref: 6C844CCC
Tk_CanvasTkwin.TK86T(?), ref: 6C844E3C

Part of subcall function 6C844910: Tk_CanvasTkwin.TK86T(?), ref: 6C84492E
Part of subcall function 6C844910: Tk_ConfigureWidget.TK86T(?,?,6C890DF8,?,?,?,?), ref: 6C84495C

Strings

canvas did not pass any coords, xrefs: 6C844CB2

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: CanvasTkwin$ConfigureCreateOutlineWidget
String ID: canvas did not pass any coords
API String ID: 2731568283-4046525298
Opcode ID: da7928ec3d925d1a1d8a0de864c35e1ad181d470c8d6300efea9f6d6374ce1b1
Instruction ID: 3b8f7b675b10e7a6359954bf24a14a59d84f59a4933110e70bba890d6c7fecdd
Opcode Fuzzy Hash: da7928ec3d925d1a1d8a0de864c35e1ad181d470c8d6300efea9f6d6374ce1b1
Instruction Fuzzy Hash: 7851EEB5A00108EFDB04CF98D994F9EB7B5BF88308F2485A9E8099B745D735AE45CB90

Function 6C7D6D50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Tk_CreateOutline.TK86T(?), ref: 6C7D6D7C
Tk_CanvasTkwin.TK86T(?), ref: 6C7D6EBA

Part of subcall function 6C7D6860: Tk_CanvasTkwin.TK86T(?), ref: 6C7D687D
Part of subcall function 6C7D6860: Tk_ConfigureWidget.TK86T(?,?,6C88BA00,?,?,?,?), ref: 6C7D68AB

Strings

canvas did not pass any coords, xrefs: 6C7D6D62

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: CanvasTkwin$ConfigureCreateOutlineWidget
String ID: canvas did not pass any coords
API String ID: 2731568283-4046525298
Opcode ID: ddf51a0edc4aa23a865271de76ab61ea9ffe39d54bfef265509aba32d67eb0bc
Instruction ID: 021f795a49b1d9db3ea25bfca4f55e23e9bc4c8842a1fd8988ba0b345ff7d826
Opcode Fuzzy Hash: ddf51a0edc4aa23a865271de76ab61ea9ffe39d54bfef265509aba32d67eb0bc
Instruction Fuzzy Hash: 77511CB4A04109EFDB04CF98C994F9EB7B5BB48308F1589A8E8099B741D735EF55CB90

Function 6C81CDF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

TkGetDisplay.TK86T(6C81BE20,6C81BE20,00000000), ref: 6C81CDFA
XSetErrorHandler.TK86T(6C81CCC0,?,6C81BE20), ref: 6C81CE2C

Strings

Unknown display passed to Tk_CreateErrorHandler, xrefs: 6C81CE0B

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: DisplayErrorHandler
String ID: Unknown display passed to Tk_CreateErrorHandler
API String ID: 4065033986-678384079
Opcode ID: f30c7f6aca1af070476b2225657d84f579bce2311e768462dfe2169ddd007eaa
Instruction ID: 7cb3d2707d92d4d50d45315098661c8a1cc5627e43fee269b82e8fef1ff831cd
Opcode Fuzzy Hash: f30c7f6aca1af070476b2225657d84f579bce2311e768462dfe2169ddd007eaa
Instruction Fuzzy Hash: 3331C8B8A00208EFCB14DF58D58499DBBF1FF48314F2486A9E8499B351D731EE92CB81

Function 6C793CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Tk_MaintainGeometry.TK86T(?,?,00000000,00000000,?,tyl,?,?,6C790D74,?,00000000,00000000,00000000,?,00000000), ref: 6C793CD0

Part of subcall function 6C810CF0: Tk_MoveResizeWindow.TK86T(?,?,?,?,?), ref: 6C810D1E
Part of subcall function 6C810CF0: Tk_MapWindow.TK86T(?), ref: 6C810D38

Tk_MapWindow.TK86T(?,?,00000000,00000000,00000000,?,00000000), ref: 6C793CFE

Strings

tyl, xrefs: 6C793CB3, 6C793CB6

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: Window$GeometryMaintainMoveResize
String ID: tyl
API String ID: 431754200-2000196680
Opcode ID: 7d280235409f0e84cd1f1ede03cce340077f432655f7a16228dbb1ddbebfe399
Instruction ID: c49faf62dd086f8026a5a320cae6cad0d57ba57625de47361bc29d5acb4f8261
Opcode Fuzzy Hash: 7d280235409f0e84cd1f1ede03cce340077f432655f7a16228dbb1ddbebfe399
Instruction Fuzzy Hash: DA01E5B9604108EFCB04CF88D991D9AB7B6FB89314B248298FC098B315D631EE51CB91

Function 6C859C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

UnregisterClassW.USER32(TkChild,?), ref: 6C859CA6
TkWinWmCleanup.TK86T(?), ref: 6C859CDA

Strings

TkChild, xrefs: 6C859CA1

Memory Dump Source

Source File: 00000002.00000002.3369093592.000000006C781000.00000020.00000001.01000000.00000024.sdmp, Offset: 6C780000, based on PE: true

Associated: 00000002.00000002.3369067676.000000006C780000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369165811.000000006C888000.00000002.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369195638.000000006C89D000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369216448.000000006C89E000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369239378.000000006C8AC000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369259565.000000006C8AE000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369281610.000000006C8B9000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369303226.000000006C8BC000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369326553.000000006C8C1000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369350028.000000006C8C2000.00000008.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369370965.000000006C8C4000.00000004.00000001.01000000.00000024.sdmpDownload File
Associated: 00000002.00000002.3369391885.000000006C8C6000.00000002.00000001.01000000.00000024.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c780000_assignee.jbxd

Similarity

API ID: ClassCleanupUnregister
String ID: TkChild
API String ID: 174452955-227893619
Opcode ID: f6973401b5fdded82b1b298721c0d2c3fb223c16131c81e70e1e803fd88c3b55
Instruction ID: 1dd1c0592902b2ffe1d8f5ca40823f56e15febce25a0c77dd66c76e91adf33cf
Opcode Fuzzy Hash: f6973401b5fdded82b1b298721c0d2c3fb223c16131c81e70e1e803fd88c3b55
Instruction Fuzzy Hash: 46F09AB4A11304EFDF20DB54CA49BAA73B4E786309F5009B8E50507740D7B9AE44EBD1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report p2K.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\assignee\Cryptodome\Cipher\_Salsa20.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aes.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_aesni.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cbc.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_cfb.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ctr.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ecb.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_eksblowfish.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ocb.pyd

C:\ProgramData\assignee\Cryptodome\Cipher\_raw_ofb.pyd

C:\ProgramData\assignee\Cryptodome\Hash\_BLAKE2s.pyd

C:\ProgramData\assignee\Cryptodome\Hash\_MD5.pyd

C:\ProgramData\assignee\Cryptodome\Hash\_SHA1.pyd

C:\ProgramData\assignee\Cryptodome\Hash\_SHA256.pyd

C:\ProgramData\assignee\Cryptodome\Hash\_ghash_clmul.pyd

C:\ProgramData\assignee\Cryptodome\Hash\_ghash_portable.pyd

C:\ProgramData\assignee\Cryptodome\Protocol\_scrypt.pyd

C:\ProgramData\assignee\Cryptodome\Util\_cpuid_c.pyd

C:\ProgramData\assignee\Cryptodome\Util\_strxor.pyd

C:\ProgramData\assignee\_ctypes.pyd

Windows Analysis Report
p2K.exe